Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    899s
  • max time network
    892s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/02/2025, 03:27

General

  • Target

    Predictor7.6.3/Predictor7.6.3.msi

  • Size

    2.9MB

  • MD5

    ae5b94abf028388af1454ed76806cc6f

  • SHA1

    ef013c7eec6fc6c14ccd414b5eb87abf1476566a

  • SHA256

    f286d2b89eaebb2e1e6e23a44bc92dae7c058348286810549f4c7514c9ea61ad

  • SHA512

    b88c3c160b68b0bdc03780a6848001aef7baa5532b815071eb4f26ff1caa87f71b2401b0c507db5389d14517310bae758aaa17f6fe7aa508f2de38cdbcac1fe2

  • SSDEEP

    49152:TL51ahTWxFOlm43he+4Xkt1i1XkIZ9fm5urK7olHgnIxQQ6brit:p8h8ME4xr461ckZPoxgnsSa

Malware Config

Extracted

Family

remcos

Botnet

v2

C2

185.157.162.126:1995

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    qsdazeazd-EL00KX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

  • Hijackloader family
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Downloads MZ/PE file 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Predictor7.6.3\Predictor7.6.3.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4676
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1444
      • C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe
        "C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe
          3⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:4576
          • C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe
            C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5092
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:5016
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU4NTU0MkQtODRFMS00M0RFLUJFOEMtMTlFNENBRUE3RjExfSIgdXNlcmlkPSJ7RjgxNzVFMjgtNEJEOC00ODEyLTk1QzMtMUQ3NkJBQjM5MzY3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjFBRTY2ODEtMjY1Qi00MkI2LUE3NDQtRURDRjkwQkE4MDI2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDMxNTkyNDczIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4364
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDU4NTU0MkQtODRFMS00M0RFLUJFOEMtMTlFNENBRUE3RjExfSIgdXNlcmlkPSJ7RjgxNzVFMjgtNEJEOC00ODEyLTk1QzMtMUQ3NkJBQjM5MzY3fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins0REMwMDcxMy0yMDI0LTRGODMtQjM5Ri1BMTIzNUU0MDEyRjl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGNvaG9ydD0icnJmQDAuMDMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7RTI4NTFCQkUtMjExMy00NDE2LTk1MTMtNjEyMDM2MTI5Q0RBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjEiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM4MzQyNTUwMDE5MjM1NzAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMjUzNDI2ODkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEyNTM0MjY4OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE0NTE1OTI4MjIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzQwMDM2YS00ZTE4LTQ1NmQtOTZmYS1kMWQ5YzRjYTQ2NzY_UDE9MTczOTcwNTMyMSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1PdHlLdmVUWGk4a3ZVYUxmMnBEc000JTJickN4UDFnSEUlMmI5d09ybzkxY21vNVlERDRUaFklMmJRJTJmRjJxcGQ5UnIlMmJoblNZZG5RZVcxeGV5UCUyZmhXR2tITnBaQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODk0IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ1MTU5MjgyMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk3MDUzMjEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9T3R5S3ZlVFhpOGt2VWFMZjJwRHNNNCUyYnJDeFAxZ0hFJTJiOXdPcm85MWNtbzVZREQ0VGhZJTJiUSUyZkYycXBkOVJyJTJiaG5TWWRuUWVXMXhleVAlMmZoV0drSE5wWkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSI1NDc2OTMiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjM5Nzc1MCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzIxMjkwNCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE0NTE1OTI4MjIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NzA1MzIxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PU90eUt2ZVRYaThrdlVhTGYycERzTTQlMmJyQ3hQMWdIRSUyYjl3T3JvOTFjbW81WURENFRoWSUyYlElMmZGMnFwZDlSciUyYmhuU1lkblFlVzF4ZXlQJTJmaFdHa0hOcFpBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iMi4yMC4xMi43NCIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjMxNCIgdG90YWw9IjMxNCIgZG93bmxvYWRfdGltZV9tcz0iMzYzMjgiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNDUxNTkyODIyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk3MDUzMjEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9T3R5S3ZlVFhpOGt2VWFMZjJwRHNNNCUyYnJDeFAxZ0hFJTJiOXdPcm85MWNtbzVZREQ0VGhZJTJiUSUyZkYycXBkOVJyJTJiaG5TWWRuUWVXMXhleVAlMmZoV0drSE5wWkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAxMjg5NCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE0NTE1OTI4MjIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NzA1MzIxJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PU90eUt2ZVRYaThrdlVhTGYycERzTTQlMmJyQ3hQMWdIRSUyYjl3T3JvOTFjbW81WURENFRoWSUyYlElMmZGMnFwZDlSciUyYmhuU1lkblFlVzF4ZXlQJTJmaFdHa0hOcFpBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iNDEyNDAxNDQiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9Ijg0NTc4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODk0IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ1MTU5MjgyMiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0id2luaHR0cCIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk3MDUzMjEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9T3R5S3ZlVFhpOGt2VWFMZjJwRHNNNCUyYnJDeFAxZ0hFJTJiOXdPcm85MWNtbzVZREQ0VGhZJTJiUSUyZkYycXBkOVJyJTJiaG5TWWRuUWVXMXhleVAlMmZoV0drSE5wWkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIyLjIwLjEyLjc0IiBjZG5fY2lkPSIyIiBjZG5fY2NjPSJHQiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4Mjg3NDg0IiB0b3RhbD0iMTc3MTgwMjE2IiBkb3dubG9hZF90aW1lX21zPSI3NTY3MiIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIyNjg0MzU0NjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNDUxNzQ4OTk3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNzM3NSIgZG93bmxvYWRfdGltZV9tcz0iNjMyNjI1IiB0b3RhbD0iMTc3MTgwMjE2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMiIgcj0iMiIgYWQ9IjY2MTIiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0ie0Q4MkM3QTY3LThDOTItNDJERC1BRkJDLUVBQ0E3MDhDQ0JGMX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZT0iNjYwOCIgY29ob3J0PSJycmZAMC40NCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins1RkUzRjIxRC01OUNGLTRGN0YtODAxMi05OTg3QjMzNjk0QzZ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3608
    • C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4328" "996" "928" "1000" "0" "0" "0" "0" "0" "0" "0" "0"
      1⤵
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:1748

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57b537.rbs

      Filesize

      10KB

      MD5

      26c04a083a06cfb496b003eb663d9232

      SHA1

      ca3b44ea60dc0606643cceaafe200a3f54503ee8

      SHA256

      93dedc518f288a4bd2dbe6a3f9380f2804098b520376cf4e3cc3d212481609b7

      SHA512

      1554d1c3c0ce0a6c333f1b9ceadf577e885598f545a3634a62d8233eb47f6c39e4cbef5a65dafb8327f77ae397c3bde20193ec2a8fcf667fc5acdc54e252494d

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

      Filesize

      839KB

      MD5

      125b8a4e69d8fad4ca40b7d642567c24

      SHA1

      624b04a8c76da191978a5b94088ece2dea981ddf

      SHA256

      62144e4e29afca07ec889bd09748263f3a9ea0a39bed4fd86ab2eefdae08378d

      SHA512

      79610b368b721186c624e56de8e0200ca787187283e609ca3f6b3450b467fb43ce87c9107305f66c942358b0c74fc4b41999efb41a1c351b941ab925029f5bd2

    • C:\Users\Admin\AppData\Local\Temp\4a5f8223

      Filesize

      1.0MB

      MD5

      9c834edc115ddbaeddf2899f92651061

      SHA1

      3ffb26c60b23cc5276e4f0c74c9c4e18b282b29a

      SHA256

      d18c573d647c6e3c117bd865723bdb85f8730bdf9d6a1706893e126ce56aa0b6

      SHA512

      94b420422ff551abf37aa8437880c4e63135d2e06a0c1bd9155ffc93c1b788b6223054032f19b2bf85165ada79ee2aa2ea42fc7d58e2bcac025ba15c5bc20034

    • C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe

      Filesize

      20KB

      MD5

      9329ba45c8b97485926a171e34c2abb8

      SHA1

      20118bc0432b4e8b3660a4b038b20ca28f721e5c

      SHA256

      effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659

      SHA512

      0af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc

    • C:\Users\Admin\AppData\Roaming\IXXinstall\MFC80U.DLL

      Filesize

      1.0MB

      MD5

      686b224b4987c22b153fbb545fee9657

      SHA1

      684ee9f018fbb0bbf6ffa590f3782ba49d5d096c

      SHA256

      a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36

      SHA512

      44d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875

    • C:\Users\Admin\AppData\Roaming\IXXinstall\audiogram.tif

      Filesize

      877KB

      MD5

      5124236fd955464317fbb1f344a1d2f2

      SHA1

      fe3a91e252f1dc3c3b4980ade7157369ea6f5097

      SHA256

      ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6

      SHA512

      2b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252

    • C:\Users\Admin\AppData\Roaming\IXXinstall\http_dll.dll

      Filesize

      1.9MB

      MD5

      fe47e255c704b20cb20c8ed93ec94d47

      SHA1

      ed7d26624b3cfaa72cf7d3bc59d26845fb84247a

      SHA256

      b0d665cb466e10ef90e1d79a39cb655ebe785d0cefc074f7a22d04936b681879

      SHA512

      55813a4b755773f98991b47294fed03b23d5bee9af3ef98727b7345882fe0d9976546f46847fbc30119e7c62ce7ee8ae21f54065922041cf8d42364e607bc1c0

    • C:\Windows\Installer\e57b536.msi

      Filesize

      2.9MB

      MD5

      ae5b94abf028388af1454ed76806cc6f

      SHA1

      ef013c7eec6fc6c14ccd414b5eb87abf1476566a

      SHA256

      f286d2b89eaebb2e1e6e23a44bc92dae7c058348286810549f4c7514c9ea61ad

      SHA512

      b88c3c160b68b0bdc03780a6848001aef7baa5532b815071eb4f26ff1caa87f71b2401b0c507db5389d14517310bae758aaa17f6fe7aa508f2de38cdbcac1fe2

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      24.1MB

      MD5

      bb7021f7862019b8b6fc127951cd7eac

      SHA1

      d500e78efe9cc7d53cd6e603687bf2f39fb1fd3e

      SHA256

      45dbddf719835ce3e9422d6286e1f085f29abc6a7890ccb04634f41f1d75fc31

      SHA512

      84639351b75e9c0fe1401e14ded92fe6cdd2e247c6f46096754c2754af2b5b8e54fced5812e459737607f32eb5b03b5373300f87e0dc5f65ef2892df7a074f52

    • \??\Volume{9342aa26-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4127c54f-e01e-4deb-85e3-1a57e8384a55}_OnDiskSnapshotProp

      Filesize

      6KB

      MD5

      8d6e0bbc728f2ac944589aa99b057aec

      SHA1

      a45424f5fc3da31bd8b198680e15804314b9f1be

      SHA256

      42d64686ef568445431b736347a0c57cd77a34acaef349764c871eda603a7bfd

      SHA512

      f4e095a983e3c2d71ede91fb74dbd55ef815af4aacd9b83eca16fd5742b293007ef4cf23edf86cc7b216a036e0e3eacdb6b8aab6fe22564dbbbd160e3dc928e4

    • memory/3680-37-0x00000000748B0000-0x0000000074A2B000-memory.dmp

      Filesize

      1.5MB

    • memory/3680-38-0x00000000748B0000-0x0000000074A2B000-memory.dmp

      Filesize

      1.5MB

    • memory/4576-41-0x00007FFC90C10000-0x00007FFC90E05000-memory.dmp

      Filesize

      2.0MB

    • memory/4576-46-0x00000000748B0000-0x0000000074A2B000-memory.dmp

      Filesize

      1.5MB

    • memory/5092-61-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-74-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-54-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-58-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-59-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-60-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-50-0x00007FFC90C10000-0x00007FFC90E05000-memory.dmp

      Filesize

      2.0MB

    • memory/5092-62-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-66-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-67-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-69-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-70-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-71-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-72-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-73-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-51-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-80-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-81-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-82-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-91-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-92-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-99-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-100-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-101-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-102-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-103-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-104-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-107-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5092-48-0x0000000072F40000-0x0000000074194000-memory.dmp

      Filesize

      18.3MB