Overview

overview

10

Static

static

3

DefenderRemover.exe

windows10-ltsc_2021-x64

3

DefenderRemover.exe

windows11-21h2-x64

Analysis

  • user interaction
    yes
  • max time kernel
    37s
  • max time network
    39s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/05/2026, 17:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    DefenderRemover.exe
  • Size 821KB
  • Sample260506-vxfe2afs5s
  • SHA256 d7b8e23375bcf4ccde720a1a79231f72babe8961724316509edc3eb68cc85955
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies firewall policy service 3 TTPs 6 IoCs
    defense_evasion
  • Windows security bypass 2 TTPs 4 IoCs
    defense_evasiontrojan
  • Modify Registry: Disable Windows Driver Blocklist 2 TTPs 2 IoCs

    Disable Windows Driver Blocklist via Registry.

    defense_evasion
  • Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 2 IoCs

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 49 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 37 IoCs
  • Runs .reg file with regedit 29 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DefenderRemover.exe
    "C:\Users\Admin\AppData\Local\Temp\DefenderRemover.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c .\Script_Run.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Windows\SysWOW64\net.exe
        net session
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 session
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2848
      • C:\Windows\SysWOW64\choice.exe
        choice /C:yas /N
        3⤵
        • System Location Discovery: System Language Discovery
        PID:728
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        Powerrun powershell.exe -noprofile -executionpolicy bypass -file "RemoveSecHealthApp.ps1"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4012
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" powershell.exe -noprofile -executionpolicy bypass -file "RemoveSecHealthApp.ps1"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3708
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ powershell.exe -noprofile -executionpolicy bypass -file "RemoveSecHealthApp.ps1"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:4708
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -executionpolicy bypass -file "RemoveSecHealthApp.ps1"
              6⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1656
              • C:\Windows\TEMP\D6B3567E-61DD-4527-8013-265B44E9ADD6\dismhost.exe
                C:\Windows\TEMP\D6B3567E-61DD-4527-8013-265B44E9ADD6\dismhost.exe {7613AF6D-1E42-4AE2-8D8C-DBF321D2D8CB}
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:5240
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable Mitigation.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5460
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable Mitigation.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5500
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable Mitigation.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable Mitigation.reg"
              6⤵
              • Modifies Windows Defender TamperProtection settings
              • Modify Registry: Disable Windows Driver Blocklist
              • Boot or Logon Autostart Execution: LSASS Driver
              • Runs .reg file with regedit
              PID:424
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable SmartScreen.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6076
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable SmartScreen.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5588
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable SmartScreen.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:5616
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable SmartScreen.reg"
              6⤵
              • Modifies data under HKEY_USERS
              • Runs .reg file with regedit
              PID:4780
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableAntivirusProtection.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4632
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableAntivirusProtection.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3168
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableAntivirusProtection.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1412
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableAntivirusProtection.reg"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Runs .reg file with regedit
              PID:4628
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1248
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:732
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:5264
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
              6⤵
              • Modifies Windows Defender notification settings
              • Windows security bypass
              • Modifies data under HKEY_USERS
              • Runs .reg file with regedit
              PID:4352
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderPolicies.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3932
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderPolicies.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5784
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderPolicies.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:4196
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderPolicies.reg"
              6⤵
              • Modifies Windows Defender DisableAntiSpyware settings
              • Modifies Windows Defender Real-time Protection settings
              • Runs .reg file with regedit
              PID:1896
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3348
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3584
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1516
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
              6⤵
              • Runs .reg file with regedit
              PID:3768
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveDefenderTasks.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3096
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveDefenderTasks.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2616
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveDefenderTasks.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:3548
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveDefenderTasks.reg"
              6⤵
              • Runs .reg file with regedit
              PID:2944
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2132
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3388
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:2520
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
              6⤵
              • Runs .reg file with regedit
              PID:5384
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveServices.reg"
        3⤵
        • Executes dropped EXE
        PID:2920
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveServices.reg"
          4⤵
          • Executes dropped EXE
          PID:5680
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveServices.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:796
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveServices.reg"
              6⤵
              • Runs .reg file with regedit
              PID:4884
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveShellAssociation.reg"
        3⤵
        • Executes dropped EXE
        PID:5380
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveShellAssociation.reg"
          4⤵
          • Executes dropped EXE
          PID:3188
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveShellAssociation.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:2736
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveShellAssociation.reg"
              6⤵
              • Modifies firewall policy service
              • Modifies registry class
              • Runs .reg file with regedit
              PID:2724
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveSignatureUpdates.reg"
        3⤵
        • Executes dropped EXE
        PID:2180
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveSignatureUpdates.reg"
          4⤵
          • Executes dropped EXE
          PID:5064
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveSignatureUpdates.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveSignatureUpdates.reg"
              6⤵
              • Runs .reg file with regedit
              PID:4968
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveStartupEntries.reg"
        3⤵
        • Executes dropped EXE
        PID:3984
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveStartupEntries.reg"
          4⤵
          • Executes dropped EXE
          PID:1408
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveStartupEntries.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:3136
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveStartupEntries.reg"
              6⤵
              • Runs .reg file with regedit
              PID:996
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
        3⤵
        • Executes dropped EXE
        PID:2484
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
          4⤵
          • Executes dropped EXE
          PID:720
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:2100
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
              6⤵
              • Modifies firewall policy service
              • Modifies registry class
              • Runs .reg file with regedit
              PID:2512
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
        3⤵
        • Executes dropped EXE
        PID:1324
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
          4⤵
          • Executes dropped EXE
          PID:4284
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1748
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
              6⤵
              • Runs .reg file with regedit
              PID:1400
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable Mitigation.reg"
        3⤵
        • Modifies Windows Defender TamperProtection settings
        • Modify Registry: Disable Windows Driver Blocklist
        • Boot or Logon Autostart Execution: LSASS Driver
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:6036
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable SmartScreen.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Runs .reg file with regedit
        PID:5956
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableAntivirusProtection.reg"
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1728
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg"
        3⤵
        • Modifies Windows Defender notification settings
        • Windows security bypass
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1100
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderPolicies.reg"
        3⤵
        • Modifies Windows Defender DisableAntiSpyware settings
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:3712
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:5816
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveDefenderTasks.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:5788
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoverofDefenderContextMenu.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1756
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveServices.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:768
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveShellAssociation.reg"
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Runs .reg file with regedit
        PID:5392
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveSignatureUpdates.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2392
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveStartupEntries.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2928
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveWindowsWebThreat.reg"
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1760
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\WindowsSettingsPageVisibility.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1416
      • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        PowerRun.exe regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_SecurityComp\Remove_SecurityComp.reg"
        3⤵
        • Executes dropped EXE
        PID:5844
        • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_SecurityComp\Remove_SecurityComp.reg"
          4⤵
          • Executes dropped EXE
          PID:2756
          • C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe" /TI/ regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_SecurityComp\Remove_SecurityComp.reg"
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:5944
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_SecurityComp\Remove_SecurityComp.reg"
              6⤵
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Runs .reg file with regedit
              PID:4324
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:2432
      • C:\Windows\SysWOW64\shutdown.exe
        shutdown /r /f /t 10
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5648
  • C:\Windows\System32\PickerHost.exe
    C:\Windows\System32\PickerHost.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5300
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa39d7855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2560

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        LSASS Driver

        1
        T1547.008

        Create or Modify System Process

        5
        T1543

        Windows Service

        5
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        LSASS Driver

        1
        T1547.008

        Create or Modify System Process

        5
        T1543

        Windows Service

        5
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Impair Defenses

        7
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Disable or Modify Tools

        5
        T1562.001

        Modify Registry

        7
        T1112

        Credential Access

        OS Credential Dumping

        1
        T1003

        LSASS Memory

        1
        T1003.001

        Discovery

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        4z0j1s2e.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\4z0j1s2e.tmp
        • Size 28KB
        • SHA256 2658178fd2cb498195032c531bf3bb037954e0614aaec4c4ac2637f08d949bc1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PowerRun.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\PowerRun.exe
        • Size 873KB
        • SHA256 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RemoveSecHealthApp.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\RemoveSecHealthApp.ps1
        • Size 1KB
        • SHA256 b29d37c2d89b1d20ae79863e55a8bd41ee430a6115d695435cf3f5976dc35d32
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Disable Mitigation.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable Mitigation.reg
        • Size 1KB
        • SHA256 60421bf96dc068bc7321905a0da5a29413e6483dc516330ca7329ff166a6084b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Disable SmartScreen.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\Disable SmartScreen.reg
        • Size 1KB
        • SHA256 8bb02edc6439c86df129e788f9e7fe040495c53d20f20cbc02000652ffe937bd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DisableAntivirusProtection.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableAntivirusProtection.reg
        • Size 1KB
        • SHA256 7dd902c8362f1388f368e88b943f9b8e54b18a29285dfb9b722bc9e430392fc8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DisableDefenderPolicies.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderPolicies.reg
        • Size 8KB
        • SHA256 99fdaaaf838c00099e5beadd4725be22cdc4687f2aded7670fa12bc95f888409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisableDefenderandSecurityCenterNotifications.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\DisableDefenderandSecurityCenterNotifications.reg
        • Size 1KB
        • SHA256 c12fa69a11f6b935d127295336b053a3a7bf3277b81bf9092e978b1420fa3bc3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RemovalofWindowsDefenderAntivirus.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemovalofWindowsDefenderAntivirus.reg
        • Size 4KB
        • SHA256 de5d76c4c1be4b15ff011c46e4ff3101f5ffd3ac7ee8bab00753feaae208f75c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RemoveDefenderTasks.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveDefenderTasks.reg
        • Size 574B
        • SHA256 8143feeb32a4edbd649ce033a551f878360603aa248faf82d01c1f292cf49a4c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RemoveServices.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveServices.reg
        • Size 1KB
        • SHA256 e33d4bec7dcef61748bf7d928a3ab0cd00ccb73711f33ad895ba93914d34d5b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RemoveShellAssociation.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoveShellAssociation.reg
        • Size 1KB
        • SHA256 778aa04d6a9395d77e16ab8b3d20b97ed459e4e06d87a051ab33dd3f090901e8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RemoverofDefenderContextMenu.reg
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Remove_defender\RemoverofDefenderContextMenu.reg
        • Size 605B
        • SHA256 83f076d81891a2079197344dd5971fc419a56d7c4263b1f17ed31c73aa026dcb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Script_Run.bat
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF09A.tmp\Script_Run.bat
        • Size 2KB
        • SHA256 0f96a9ff12f9feb0b0a5f388f3f8a048be150ddc32123a8351607f4bdcd2be6c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aut38FD.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\aut38FD.tmp
        • Size 11KB
        • SHA256 2d993be76dfcf35f89b656b4dbc553e078d824974b482e56c6f76eaea87731c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aut38FE.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\aut38FE.tmp
        • Size 10KB
        • SHA256 365c32c3c09228158ab5aaabfcf93cdfcd858be0b2a00031d82ab03070f61a5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aut38FF.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\aut38FF.tmp
        • Size 5KB
        • SHA256 3e56c22a81ab1168036a289c7ffe2889dd678c422568dff9ef91d6a0f9005333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 288KB
        • SHA256 9ffbfc98c5e3105423d6e2f63eb240251f01673d61f3f0a5fb799ab3b194f11c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 289KB
        • SHA256 82507a215c9c697f89213921da19d0c62b2a25ba8fb5363b32be8c0fb72bfc56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 293KB
        • SHA256 de60d701223f2deaab205b1b76df7c822b7492d6471befbf3e3e5c89750692d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LogProvider.dll
        • Path C:\Windows\TEMP\D6B3567E-61DD-4527-8013-265B44E9ADD6\LogProvider.dll
        • Size 108KB
        • SHA256 56aca41c62c8d0d1b26db3a01ef6c2da4a6a51fc963eb28411f8f7f029f1bfde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSProvider.dll
        • Path C:\Windows\TEMP\D6B3567E-61DD-4527-8013-265B44E9ADD6\OSProvider.dll
        • Size 180KB
        • SHA256 ec137f9caebcea735a9386112cf68f78b92b6a5a38008ce6415485f565e5cf85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dismprov.dll
        • Path C:\Windows\TEMP\D6B3567E-61DD-4527-8013-265B44E9ADD6\dismprov.dll
        • Size 292KB
        • SHA256 006464f42a487ab765e1e97cf2d15bfa7db76752946de52ff7e518bc5bbb9a44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppxProvider.dll
        • Path C:\Windows\Temp\D6B3567E-61DD-4527-8013-265B44E9ADD6\AppxProvider.dll
        • Size 664KB
        • SHA256 37f45e6fc1e531279dcffed70c420df7b073504efe43bbb99a33a9ec24b75a47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismCorePS.dll
        • Path C:\Windows\Temp\D6B3567E-61DD-4527-8013-265B44E9ADD6\DismCorePS.dll
        • Size 200KB
        • SHA256 db995f4f55d8654fc1245da0df9d1d9d52b02d75131bc3bce501b141888232fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismHost.exe
        • Path C:\Windows\Temp\D6B3567E-61DD-4527-8013-265B44E9ADD6\DismHost.exe
        • Size 168KB
        • SHA256 dead0ebd5b5bf5d4b0e68ba975e9a70f98820e85d056b0a6b3775fc4df4da0f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_sn3nlocb.o3o.ps1
        • Path C:\Windows\Temp\__PSScriptPolicyTest_sn3nlocb.o3o.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1656-265-0x00000242233D0000-0x00000242233F6000-memory.dmp
        Download

        memory/1656-263-0x000002420AD30000-0x000002420AD3A000-memory.dmp
        Download

        memory/1656-261-0x0000024222D50000-0x0000024222D6C000-memory.dmp
        Download

        memory/1656-201-0x000002420AC90000-0x000002420ACB2000-memory.dmp
        Download

        memory/1656-826-0x0000024223400000-0x000002422341C000-memory.dmp
        Download

        memory/1656-828-0x0000024222D60000-0x0000024222D6A000-memory.dmp
        Download

        memory/1656-829-0x0000024223490000-0x00000242234B6000-memory.dmp
        Download

        memory/1656-262-0x0000024222D70000-0x0000024222E23000-memory.dmp
        Download

        memory/1656-884-0x0000024208E90000-0x0000024208E9C000-memory.dmp
        Download

        memory/1656-885-0x000002420A7C0000-0x000002420A7D2000-memory.dmp
        Download