Analysis
- user interaction
yes - max time kernel
300s - max time network
302s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
05/07/2026, 19:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
kgguanc_btco_x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
34 signatures
300 seconds
Behavioral task
behavioral2
Sample
kgguanc_btco_x64.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
34 signatures
300 seconds
Behavioral task
behavioral3
Sample
kgguanc_btco_x64.msi
Resource
win11-20260513-en
windows11-21h2-x64
33 signatures
300 seconds
Behavioral task
behavioral4
Sample
kgguanc_btco_x64.msi
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
32 signatures
300 seconds
General
- Target kgguanc_btco_x64.msi
- Size 165.6MB
- Sample260705-xntbmsay3n
- SHA256 9d5b2083b09fefad811b83f7503a3db0a8568b60c21ab2b4ef61c16720e047a9
- MD5 51403bd189ad54c81195e1b8f8132416
- SHA1 55426347e47b128e88a8bc3a5b0cf78d67edb37b
- SHA512 c071769073b5fbb2a8866dd18b7ae759378af79bde33138dd9768ff3b99016d075c232806b976c545df5cb3eda80cab88689c7a19ce75ba1033eae4e4c00f63b
- SSDEEP 3145728:VGZO6R9khzofr6kbFdaU5bS0DU9ON46VPsUv6A5up60wgN7FCKn4Xha:VGNshGHzJbA9ON4CDvr5N0w8nf
- TLSH T1A5883332F2656DA9E62F637FA4645F89403C7CA1731A9AABA37C7FB185705831072C43
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/5404-307-0x0000000006B00000-0x000000000780A000-memory.dmp family_gh0strat behavioral2/memory/5404-404-0x0000000006B00000-0x000000000780A000-memory.dmp family_gh0strat -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" fhbmini.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Agghosts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Agghosts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5" Agghosts.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
pid Process 4636 Powershell.exe 3260 Powershell.exe 6136 Powershell.exe 5064 powershell.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation TIM.exe Key value queried \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation WScript.exe - Executes dropped EXE 12 IoCs
pid Process 6140 Tgpvqvsv.exe 5404 TaskLoad.exe 5656 TaskLoad.exe 2884 fontduxhost.exe 4840 fhbmini.exe 5712 fontduxhost.exe 1192 fhbmini.exe 3516 WallPaper.exe 3984 MiniStorPlay.exe 1152 TIM.exe 4116 Agghosts.exe 224 fontduxhost.exe - Loads dropped DLL 37 IoCs
pid Process 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 2272 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 6140 Tgpvqvsv.exe 6140 Tgpvqvsv.exe 6140 Tgpvqvsv.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5656 TaskLoad.exe 5656 TaskLoad.exe 5656 TaskLoad.exe 4840 fhbmini.exe 4840 fhbmini.exe 4840 fhbmini.exe 1192 fhbmini.exe 1192 fhbmini.exe 1192 fhbmini.exe 3516 WallPaper.exe 3516 WallPaper.exe 3516 WallPaper.exe 3516 WallPaper.exe 3516 WallPaper.exe 3984 MiniStorPlay.exe 4116 Agghosts.exe 4116 Agghosts.exe 4116 Agghosts.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" fhbmini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FHBminiApp = "C:\\ProgramData\\FFWallpaper\\fhbmini.exe" fhbmini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SafeE975 = "C:\\ProgramData\\FFWallpaper\\fhbmini.exe" TaskLoad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" fhbmini.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TaskLoad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Agghosts.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: TaskLoad.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: TaskLoad.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: TaskLoad.exe File opened (read-only) \??\Z: TaskLoad.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: TaskLoad.exe File opened (read-only) \??\V: TaskLoad.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: TaskLoad.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: TaskLoad.exe File opened (read-only) \??\L: TaskLoad.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: TaskLoad.exe File opened (read-only) \??\U: TaskLoad.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: TaskLoad.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: TaskLoad.exe File opened (read-only) \??\M: TaskLoad.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: TaskLoad.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: TaskLoad.exe File opened (read-only) \??\T: TaskLoad.exe File opened (read-only) \??\W: TaskLoad.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: TaskLoad.exe File opened (read-only) \??\X: TaskLoad.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: TaskLoad.exe File opened (read-only) \??\P: TaskLoad.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontduxhost.exe.log fontduxhost.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2560 tasklist.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5536 MsiExec.exe -
resource yara_rule behavioral2/memory/6140-197-0x0000000003510000-0x0000000003552000-memory.dmp upx behavioral2/memory/5404-208-0x00000000011A0000-0x00000000011E2000-memory.dmp upx behavioral2/memory/5404-212-0x0000000003110000-0x0000000003157000-memory.dmp upx behavioral2/memory/5404-211-0x00000000011A0000-0x00000000011E2000-memory.dmp upx behavioral2/memory/5404-296-0x0000000004F40000-0x0000000005C4A000-memory.dmp upx behavioral2/memory/5404-303-0x0000000006B00000-0x000000000780A000-memory.dmp upx behavioral2/memory/5404-307-0x0000000006B00000-0x000000000780A000-memory.dmp upx behavioral2/memory/5656-343-0x0000000003330000-0x0000000003372000-memory.dmp upx behavioral2/memory/5656-346-0x0000000003330000-0x0000000003372000-memory.dmp upx behavioral2/memory/5656-367-0x0000000003330000-0x0000000003372000-memory.dmp upx behavioral2/memory/5404-404-0x0000000006B00000-0x000000000780A000-memory.dmp upx behavioral2/memory/4840-448-0x00000000030A0000-0x00000000030DF000-memory.dmp upx behavioral2/memory/4840-451-0x00000000030A0000-0x00000000030DF000-memory.dmp upx behavioral2/memory/1192-465-0x0000000003110000-0x000000000314F000-memory.dmp upx behavioral2/memory/1192-468-0x0000000003110000-0x000000000314F000-memory.dmp upx behavioral2/memory/3516-475-0x0000000002670000-0x00000000026B5000-memory.dmp upx behavioral2/memory/4116-482-0x0000000002A90000-0x0000000002AE9000-memory.dmp upx behavioral2/memory/4840-496-0x00000000030A0000-0x00000000030DF000-memory.dmp upx - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\_8 MsiExec.exe File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\dll1.dll MsiExec.exe File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\libcef.dll MsiExec.exe File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\Tgpvqvsv.exe MsiExec.exe File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\WS_Log.dll MsiExec.exe File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\FourierTransformLib8.dll MsiExec.exe File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\ImageRestoreLib8.dll MsiExec.exe File created C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\wavelet_3_8.dll MsiExec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{6B97E3A6-09AE-49C1-B9BA-A9E407E041F3}\APPDIRqsyyapgpv3.2.1win32_doplx64_1.exe msiexec.exe File opened for modification C:\Windows\Installer\{6B97E3A6-09AE-49C1-B9BA-A9E407E041F3}\APPDIRqsyyapgpv3.2.1win32_doplx64_1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIFABB.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58f008.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{6B97E3A6-09AE-49C1-B9BA-A9E407E041F3} msiexec.exe File opened for modification C:\Windows\Installer\MSIF54B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI142F.tmp msiexec.exe File created C:\Windows\Installer\e58f008.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF102.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF1BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF20E.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4620 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tgpvqvsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskLoad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbmini.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agghosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WallPaper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskLoad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbmini.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MiniStorPlay.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4016 PING.EXE - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000483bb63a526d2ab10000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801483bb63a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101483bb63a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f483bb63a00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71483bb63a00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TaskLoad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TaskLoad.exe - Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\Desktop fhbmini.exe Set value (int) \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\Desktop\DpiScalingVer = "1018" fhbmini.exe Set value (int) \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\Desktop\Win8DpiScaling = "1" fhbmini.exe Set value (int) \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\Desktop\LogPixels = "96" fhbmini.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Wskcmqgamuikkc\Host = "23.106.141.194" TaskLoad.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Wskcmqgamuikkc TaskLoad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\S\ver = "C:\\Testoutput\\TestWord" TaskLoad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates Powershell.exe Key created \REGISTRY\USER\.DEFAULT\V TaskLoad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs Powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Powershell.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings TIM.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4016 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5340 msiexec.exe 5340 msiexec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 3260 Powershell.exe 3260 Powershell.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 5536 MsiExec.exe 6140 Tgpvqvsv.exe 6140 Tgpvqvsv.exe 6140 Tgpvqvsv.exe 6140 Tgpvqvsv.exe 6140 Tgpvqvsv.exe 6140 Tgpvqvsv.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe 5404 TaskLoad.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4620 msiexec.exe Token: SeIncreaseQuotaPrivilege 4620 msiexec.exe Token: SeSecurityPrivilege 5340 msiexec.exe Token: SeCreateTokenPrivilege 4620 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4620 msiexec.exe Token: SeLockMemoryPrivilege 4620 msiexec.exe Token: SeIncreaseQuotaPrivilege 4620 msiexec.exe Token: SeMachineAccountPrivilege 4620 msiexec.exe Token: SeTcbPrivilege 4620 msiexec.exe Token: SeSecurityPrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeLoadDriverPrivilege 4620 msiexec.exe Token: SeSystemProfilePrivilege 4620 msiexec.exe Token: SeSystemtimePrivilege 4620 msiexec.exe Token: SeProfSingleProcessPrivilege 4620 msiexec.exe Token: SeIncBasePriorityPrivilege 4620 msiexec.exe Token: SeCreatePagefilePrivilege 4620 msiexec.exe Token: SeCreatePermanentPrivilege 4620 msiexec.exe Token: SeBackupPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeShutdownPrivilege 4620 msiexec.exe Token: SeDebugPrivilege 4620 msiexec.exe Token: SeAuditPrivilege 4620 msiexec.exe Token: SeSystemEnvironmentPrivilege 4620 msiexec.exe Token: SeChangeNotifyPrivilege 4620 msiexec.exe Token: SeRemoteShutdownPrivilege 4620 msiexec.exe Token: SeUndockPrivilege 4620 msiexec.exe Token: SeSyncAgentPrivilege 4620 msiexec.exe Token: SeEnableDelegationPrivilege 4620 msiexec.exe Token: SeManageVolumePrivilege 4620 msiexec.exe Token: SeImpersonatePrivilege 4620 msiexec.exe Token: SeCreateGlobalPrivilege 4620 msiexec.exe Token: SeCreateTokenPrivilege 4620 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4620 msiexec.exe Token: SeLockMemoryPrivilege 4620 msiexec.exe Token: SeIncreaseQuotaPrivilege 4620 msiexec.exe Token: SeMachineAccountPrivilege 4620 msiexec.exe Token: SeTcbPrivilege 4620 msiexec.exe Token: SeSecurityPrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeLoadDriverPrivilege 4620 msiexec.exe Token: SeSystemProfilePrivilege 4620 msiexec.exe Token: SeSystemtimePrivilege 4620 msiexec.exe Token: SeProfSingleProcessPrivilege 4620 msiexec.exe Token: SeIncBasePriorityPrivilege 4620 msiexec.exe Token: SeCreatePagefilePrivilege 4620 msiexec.exe Token: SeCreatePermanentPrivilege 4620 msiexec.exe Token: SeBackupPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeShutdownPrivilege 4620 msiexec.exe Token: SeDebugPrivilege 4620 msiexec.exe Token: SeAuditPrivilege 4620 msiexec.exe Token: SeSystemEnvironmentPrivilege 4620 msiexec.exe Token: SeChangeNotifyPrivilege 4620 msiexec.exe Token: SeRemoteShutdownPrivilege 4620 msiexec.exe Token: SeUndockPrivilege 4620 msiexec.exe Token: SeSyncAgentPrivilege 4620 msiexec.exe Token: SeEnableDelegationPrivilege 4620 msiexec.exe Token: SeManageVolumePrivilege 4620 msiexec.exe Token: SeImpersonatePrivilege 4620 msiexec.exe Token: SeCreateGlobalPrivilege 4620 msiexec.exe Token: SeCreateTokenPrivilege 4620 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4620 msiexec.exe Token: SeLockMemoryPrivilege 4620 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4620 msiexec.exe 4620 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5404 TaskLoad.exe 1152 TIM.exe 1152 TIM.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5340 wrote to memory of 4820 5340 msiexec.exe 85 PID 5340 wrote to memory of 4784 5340 msiexec.exe 91 PID 5340 wrote to memory of 2272 5340 msiexec.exe 93 PID 5340 wrote to memory of 5536 5340 msiexec.exe 94 PID 5536 wrote to memory of 3260 5536 MsiExec.exe 96 PID 5536 wrote to memory of 6140 5536 MsiExec.exe 103 PID 6140 wrote to memory of 5404 6140 Tgpvqvsv.exe 105 PID 5404 wrote to memory of 6136 5404 TaskLoad.exe 109 PID 5404 wrote to memory of 5656 5404 TaskLoad.exe 111 PID 5404 wrote to memory of 5064 5404 TaskLoad.exe 112 PID 5404 wrote to memory of 4636 5404 TaskLoad.exe 114 PID 4840 wrote to memory of 1192 4840 fhbmini.exe 122 PID 3984 wrote to memory of 1152 3984 MiniStorPlay.exe 128 PID 1152 wrote to memory of 896 1152 TIM.exe 129 PID 896 wrote to memory of 2596 896 WScript.exe 130 PID 2596 wrote to memory of 4116 2596 cmd.exe 132 PID 2596 wrote to memory of 4016 2596 cmd.exe 133 PID 2596 wrote to memory of 2560 2596 cmd.exe 134 PID 2596 wrote to memory of 4000 2596 cmd.exe 135 - System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Agghosts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5" Agghosts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Agghosts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Agghosts.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\kgguanc_btco_x64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4620
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 09B121D97C554A992118EDEDC6978F7A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4820
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4784
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6D71F25961DB0B8AC766AD16F1F5B3A92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2272
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 813FA6E3C7A4AFFC35C5C4C11DDF6050 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe"C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -ExecutionPolicy Bypass -Command "Set-MpPreference -EnableControlledFolderAccess Disabled ; add-MpPreference -ExclusionPath "C:\ProgramData","C:\Users\Public\Documents",'C:\Program Files'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\Tgpvqvsv.exe"C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\Tgpvqvsv.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Public\Documents\TaskLoad.exeC:\Users\Public\Documents\TaskLoad.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe"C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -ExecutionPolicy Bypass -Command "Set-MpPreference -EnableControlledFolderAccess Disabled ; add-MpPreference -ExclusionPath "C:\Users\Public\Music","C:\Users\Public\Videos","C:\ProgramData","C:\Users\Public\Documents",'C:\Users\Public\Documents','C:\ProgramData\FFWallpaper','C:\Users'"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:6136
-
-
C:\Users\Public\Documents\TaskLoad.exe"C:\Users\Public\Documents\TaskLoad.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5656
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-MpPreference).ExclusionPath"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5064
-
-
C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe"C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -WindowStyle Hidden -Command "Unregister-ScheduledTask -TaskName 'WindowsPowerShell.WbemScripting.WindowsData' -Confirm:$false; Remove-Item -Path 'C:\Windows\System32\Tasks\WindowsPowerShell.WbemScripting.WindowsData' -Force"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4636
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2264
-
C:\ProgramData\Windows10CW\fontduxhost.exe"C:\ProgramData\Windows10CW\fontduxhost.exe" install1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2884
-
C:\ProgramData\FFWallpaper\fhbmini.exeC:\ProgramData\FFWallpaper\fhbmini.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\ProgramData\FFWallpaper\fhbmini.exe"C:\ProgramData\FFWallpaper\fhbmini.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1192
-
-
C:\ProgramData\Windows10CW\fontduxhost.exeC:\ProgramData\Windows10CW\fontduxhost.exe1⤵
- Executes dropped EXE
PID:5712
-
C:\Users\Public\Documents\RECSLLE.BIN\WallPaper.exeC:\Users\Public\Documents\RECSLLE.BIN\WallPaper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3516
-
C:\Users\Public\Documents\RECSLLE.BIN\system\MiniStorPlay.exeC:\Users\Public\Documents\RECSLLE.BIN\system\MiniStorPlay.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Public\Documents\RECSLLE.BIN\system\TIM.exe"C:\Users\Public\Documents\RECSLLE.BIN\system\TIM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\dx.vbs"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\cba.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\ProgramData\Agghosts.exeC:\ProgramData\Agghosts.exe5⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
PID:4116
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4016
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
PID:2560
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "Agghosts.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4000
-
-
-
-
-
C:\ProgramData\Windows10CW\fontduxhost.exe"C:\ProgramData\Windows10CW\fontduxhost.exe"1⤵
- Executes dropped EXE
PID:224
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
4System Binary Proxy Execution
1Msiexec
1Discovery
Peripheral Device Discovery
2Process Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58f009.rbs
- Size 29KB
- SHA256 baf3b259ef3633a08678cdc2d1bd85a5819ba4ca0d20a1babd8c88e154977369
- MD5 5779b1b310fcf7517c81597d6401d2cc
- SHA1 e77beb565d637c57c97c6e1a56e6ebc9113fe5f4
- SHA512 ce9dc29aee318e9c24f934bf957ca870decd397926942601ca9080a8a1c0c98e430786185b5bbafc377bd68457172db6a44575e56bcce7114a4cfd8cb5054c16
- SSDEEP 768:4dfjHLYbFhOuMW6HRYT2Ip4wqxf1mlv2Ue1Pl:KrHW4W6xR9tfI+b5l
- TLSH T1CBD27DC297AC52B3EB432A71C3E9E943B57967D357515CEF989A805909023D0FF3C229
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\23M67E23I87S-3S7W3E7A-2S6Q3C8I-3A7E2C7A\dll1.dll
- Size 191KB
- SHA256 f1fb4db77fcc50d839523d8df7a0d04a5110320cce1718cf3728ea1be7b2a6f8
- MD5 0d7d0cf8a31422cd9a88fa90ad7560eb
- SHA1 63c99d72c623bbd3441a8cb75f7ad9da5bc9975f
- SHA512 ce0846872dcec6da0ec52f195e64b10347a8de690e7a44803fe143f35365f015d05844f657430631366d1958a6de1a481951a966c183e5a856a28d5a39d4ae7e
- SSDEEP 3072:df/uWjMuqQwc3K559PbbyQzu4HRt7wWtemQFI/LWu:df/uHuqQwc37CRtseiFI/Lv
- TLSH T1EE147DC1B64E40F1D9851A75209A37379F380747051ADFC3E724CFEA5A23162ADED3AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\1
- Size 978KB
- SHA256 4fcf6394b14e24d830b04209a0ede1dcc911d199740a55d12c8ab8aeabb84073
- MD5 8e945aaf7128bb3db83e51f3c2356637
- SHA1 bcc64335efc63cb46e14cc330e105520391e2b00
- SHA512 150636eea0cab3e738f5e94ae910d189622fa3221aca1cecc05bf0f5a80f2fab055adeafd99eab7a2a1d3911ff2784cf521a2681e5ddf7737f4363b915b8c2a8
- SSDEEP 24576:MnWZ+oarDqLUgqdcx9DC2T17qVyd+cnsAutKKNWi+26TYeuD5:uIBUfdcx9DC2T17qEd3PKNWZYeuV
- TLSH T16A256C203A55C07ADE6220B14E7EF6AE149DA5504F715DCFE3CC0B6DAFB05C21B3692A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\2
- Size 3.3MB
- SHA256 8e6d7eb780d6e05a7728061d06bab9dabc280c4906b3f07a577d737924bbada6
- MD5 55525d13dbd0d7909fa312f9ba33906c
- SHA1 e4de2e6d53caf9e5ba0e776524fffbd6e70e66dc
- SHA512 6e1ea406af8b454d2d96f288af3e95c741e94ecc677b3f5c5f7eee175563e73e667e4ec838470dc15c5d54f77f775948d24473ef55b8105288117def1268aa46
- SSDEEP 49152:qcE/INNbpv0k+7lx6WPBCwxQ6fGzSnojbrTsNW2ixTpjnkuZSCeo8mOSOEVzxY:VbpZJ+TvAuOrTs3idlkESZmB
- TLSH T1C4F512F3D6791045E4D58C3A9F27BD91B0B68367CB43FC7807DA88C025267E1E2629A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\23M67E23W87A-3A7M3M7M-2I6E3O8S-3K7C2G7Y\_fhbminius.exe
- Size 170KB
- SHA256 60503684f39425c5505805a282eb010ecb8148bbf7efe9bba9cf33c507af7f3a
- MD5 0d318144bd23ba1a72cc06fe19cb3f0c
- SHA1 91a270d8e872ea2a185309ca9ce5d9f08047809e
- SHA512 a3f3c7d84644b13868ac324947c2d678620e341e368b781d45f244a53f448d6b24be7b50ac9908728dfbbb74214fcb46902137910e907f14f601518c0efd215b
- SSDEEP 3072:Q0HJ5wo1/MJjozYJimE2BamDKigu/fgl1glfdjgBftJeCE5vLEnM7QrRz:/J5wUmhkmDKVuE1gQJeCERLG1F
- TLSH T1AB049D5376D1D072E46F097008A8D5B19F3EFE615B308ABB3398123E1FA51C199768BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\23M67E23W87A-3A7M3M7M-2I6E3O8S-3K7C2G7Y\vcruntime140.dll
- Size 78KB
- SHA256 9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
- MD5 1b171f9a428c44acf85f89989007c328
- SHA1 6f25a874d6cbf8158cb7c491dcedaa81ceaebbae
- SHA512 99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1
- SSDEEP 1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
- TLSH T12773AE22F0D180BFC566857452BAEA036B3D9A510FE18EDB6F986D841F79BC1E730217
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\44
- Size 4.2MB
- SHA256 34bce2d16202f09475477096d3bf6e1e8129b959cfb58c2ca903f643af88e98b
- MD5 4e7b463319190174f6c49a1ad14b8a78
- SHA1 a3cdd544a1ee7da5d16271afa643008a706c06e3
- SHA512 e1a055ea12e64ee06db9571fbd67312d18a3d228fce5cd2d19d758c01faf55e2b40e68b0472319077ed6e157dffcc1e58416ca70040a5f6f00e6b7aaa97ef601
- SSDEEP 98304:SIrlR8t4xfFw3bZvkFti44APyS8fmU/iGUFcF3C/rdCSiAImA+:PlR8tkA2iXNSPU/iGUmt0J
- TLSH T1F81633D9B090A70F746A9A0144BFAB7D487438B713642F4D2A82E0B51CFE6A350B77E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\FFWallpaper\libmini.dll
- Size 376KB
- SHA256 95d15a8986844ea6ec1ac56c929f18ba0857d5d96171c7cb41b663a0816715bc
- MD5 2a7b4a8746e0efa3ff668acd278825ca
- SHA1 2d652e4cd2237d31547b010c01e65eb7ee5a9b34
- SHA512 d2826174823acd98e6d0f64c53c35b8d7acbd062bd021a9450d16aacef3bc2aebc7b98c25b55d0ebe66768a80c2947149d7d28b44ffcb097fc2163c3e91f0479
- SSDEEP 6144:bgGQZvI+Z8kq7Jjw4Gf9D9Bek9QygLtsur:6SZGHBl9KtsS
- TLSH T16F844C75B14B4DB6C47B1777CEDA38398034F950077A84AF8AC4DBD94AE618BCCE2189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\SkySky\dll1.dll
- Size 396KB
- SHA256 c07525e7f8eaec1676af02911811452b56821c6f1a3b5b6906350b5a214a5cb1
- MD5 532645fb3465b35e970b231cb783adad
- SHA1 1f6edcf22f1bbe9c67e8454a56e3f12b74d7935e
- SHA512 547a0e5078cd2e042daa501b7e8096e29f73e346b9d1d9e3c3c41a9e586d124a7096b2c843106770eb00457304587b9c1cf621051c042a24a4f6685f70a4a4f0
- SSDEEP 3072:akmYTLUabJ4YQot39HTCdF76qRa9YaKFFDoew+khRXgEHNMLSRbNzmLeW1:Eu4YQot39HTidBTaKHDoehYpgEHNQSb
- TLSH T1AF84079190F478ACDF6FC97296F626D442A97E512A803BB74747BB8C4732187FC2052E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Windows10CW\fontduxhost.exe
- Size 832KB
- SHA256 923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66
- MD5 d305d506c0095df8af223ac7d91ca327
- SHA1 679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a
- SHA512 94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796
- SSDEEP 12288:w5KA2umXkgSSWBpeC5wtKDAOQrM3IbMZuuW1phJb9RlTTzIXGa0/Zxi0akv+9a9h:wleX1phJbpraX0BvX2
- TLSH T18B054A507BF4861BF4BE2BB2E9B105281BB4F486F6B6F74F178861A81C927408D513B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Windows10CW\fontduxhost.xml
- Size 439B
- SHA256 7f3c4a140ce7561d39434491a8d9f3913fc443a58b0b458c872e44a6d8ba5b0a
- MD5 0da790db982775ba21ba583818945b36
- SHA1 bead404d4e301b314e3d1b94d2b97342b687bc4d
- SHA512 5fe3008c49eece44e6f6d6ca18d4d5f96b71f074df595f88f4ed54f78425191705cb61c40fe48409036db55ff7c968b97f501e42e899f0d8c1ab265cf666707f
- TLSH T187F0A39014D775F319EE64A17635935E1133D35875CC5CA073CB871765408C8A0ABF17
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Xfdedxdrtf
- Size 39.6MB
- SHA256 b9f34cf2b1abe396bb097db1e98c4f001fbfefa87379b0e016e698bf11f977c9
- MD5 53e2545634b77c9fff919cc94b45769e
- SHA1 f4871b2f3fc32475f61931341c346a747e6c1a7a
- SHA512 2ae588ef1cbd8191c78422b1b49210e55a0d25d637530f0e7a2c6fbd34caebd921f70d8c9de9c4e89a95a1e54f82f154ee1368a6ba4d1870143d4b0d53f4be25
- SSDEEP 786432:dHXpgITX1pJN9xaYI/3HbFzA6Yg0Wr9NUayQllR7jDwr95cNGX+xKFQ:52IT1Jv23HRSNm9hdl7H8vKCQ
- TLSH T1DC97332687B5E68DE7186C4E885CADEC0B9D0F60C59826BF6335D95E1F9C381E9933C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\YYbfbfacbbfc.dat
- Size 170B
- SHA256 7e989aedf13f598af7ddf6eaa4ceaa1c84bdb5af606464db8f768cafac48ceb8
- MD5 b565f565d2fe78b56bb7a45192af9546
- SHA1 3e73f8c4f211bf2ab505d0982f7fb1f1e8b60240
- SHA512 803c176febaf1698a6d339445e20e384e306982e6e6e8781e44e32540188c0b490a128a63180abf7fbc8581a78f3421d3f34b52d21ec0e6d1fe1aea5e9afa576
- TLSH T1BCC0044111544341C4000CF0C00C4D41455075DD43101404F340D5C04D00C137D1D7F7
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\YYbfbfacbbfc.dat
- Size 170B
- SHA256 cc0ae5dc3c86aff125875717e2d51d5af1e8c2d28a03b0874a88539a78bfa8d8
- MD5 866750132964c11bd889d47573eb5013
- SHA1 5d5cf679ba572b01c55eaba3f84dc44ab9745291
- SHA512 566a965da6e1157e172c2f537ce9858c192298adc59ba2f72bb99ae9516e59eb5bf9cdcef1b0c530f4e660392d1bd5b91772efc868dead5347ae999b455d9b29
- TLSH T1D2C0028211544241C4000CB0C40C4D454990659946116604A68095804D00C12A91D6E6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\a10
- Size 36KB
- SHA256 2514913f8a6f4671a058304651289b0babe47d81c044212b3140ed1c1b643b09
- MD5 f0284892937a97caa61afcd3b6ddb6d4
- SHA1 f3c308e7e4aaa96919882994cdd21cc9f939cabd
- SHA512 058845e0a9a5892a69f24f3a77086e3f9546493ad40a0e5359aed05cf8882a9f3d7aee0449648d5cb76e51530af3e46af59a9b196cc92318334116c92dde4171
- SSDEEP 384:/oeSoJ0KOZx4nfU6vD0flphf5evr0vRCGuMos0pIo3:/ogJMKf/7clzf/vRl5os0pt
- TLSH T164F2E685C787D4F0DB9B2D31908F773B113276A279B6CB875B44CB0E9C2D21BA92DA05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\a3
- Size 18B
- SHA256 75c121c71b8f184ea8bafe76a9cddf4f54231edaac12c08914116e018051e205
- MD5 43b1bd1d9530a76239a22f2cc4dd5622
- SHA1 276148100e507ac9abf28b8c86c09f659124aecb
- SHA512 a6cc86d2beca6411ae471899bd4f2d04680da88493ee4baf5000a5e3135f4493636c7f88cafd694754d78e95c0586d6ed2e18972b71e44a66fd9ac67de0112b8
- MD5 SHA1 SHA512
- Path C:\ProgramData\a6
- Size 200KB
- SHA256 ed2c6bc3e77a404b8cf61176844ad19c1fdcae19881206631e3f0831a4bd919a
- MD5 078c21b8c91b86999427aa349cf5decf
- SHA1 b939376eaebcf6994890db24ddcb2380c1925188
- SHA512 a006a36fdcaf4c2403238475163553ba2fe7783fea200f28df46ea980a3907d2b24c854153b45b730195a133fcb28f60c157f33c865ea286ad8c354981cf5885
- SSDEEP 3072:9+Ays9aGPgZtrq8eQMoHGFgJdi8GwQCpUd1/g:Q0a1trqXQMOCY41/g
- TLSH T15A148C123681C073E6971134452AD7766ABBF87807254AC7FBD80AB95F217D28E3638A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\a7
- Size 509KB
- SHA256 66e1fecebf4d49c5a76c590eac504bccb72c9d0150d1a3addc17bb99cbfecbf5
- MD5 ffd966e8f6fde22c04186a9b84f6211a
- SHA1 5f18b68010a5dd37767764fe95790f4a58be1162
- SHA512 58e3e1d2dac5b2b529829460f9a46aed60d707f9a60471deabd9e4f9ec47084ef41f45619a3a1af197afe4c5b0cea04cb36ce09dc97d81b7d16f42fa7d9b145b
- SSDEEP 6144:o7InjmU1n1SkNFczPqeeOFVmg0UqxfqejRaGtriUmaJ:oUv1nAkN6NFVmg9SqIRaOx
- TLSH T1A8B43F66F99CAC3CBC9CFB40ED077D694814623AD461B12B2AEF2189C7D82B147791D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\a8
- Size 21KB
- SHA256 9bd52ec7e7750500de33df995fcc7e68ed1da70d125579cf76ae8f787577ef75
- MD5 da08e194f9a7045dbb19f6e5d5d7f609
- SHA1 7884062382bf1e7911f7e74198ca9fecec159c61
- SHA512 46720cd0677064b00a9e253953b8b6cd5141a99d0090ff0d7c4a24b830ca621878bcdfec3c56880f940662bd78f408782231bdd3cb370e06dadfee71e3e2b2b0
- SSDEEP 384:4JLt2PFgFZp+3SzgqTozaohbkDpct+UpPOv+NkEcOAP06DngEQzrbkUFUF2Fk:4JLt26X+egAotAUKUoOq
- TLSH T14EA208436AEA92F3FB196830A0F56A1B120D660BA741BFE7E7638F15C5521E2343914F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\a9
- Size 13KB
- SHA256 6feeb95115d7d8a51403996fee1ad219a52151662d3a01a2d17cfb77dbd51f3b
- MD5 37aa892a6f35bcbe9b01f0a424f5d4f6
- SHA1 e5d60e43a8e0a4b7371bd736e21b1a59546774af
- SHA512 a5d5ac494cba18bb5b2582310416dc2e146732ba4f2eddab6611393d61ac0ae839bacae0da1e85f0965575e6d6284b1180e2e3adb924f1e19d2d7586d2abbd83
- SSDEEP 384:gtxdY5YkXU7t9du4G0HxJjCuEmFWZLA06qg4+:grS5nCJR/Hdt
- TLSH T10D523C02BB8643B3DE8F213931966852520D614217823B937FB38B0D69B76F0AC7E647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Powershell.exe.log
- Size 2KB
- SHA256 883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b
- MD5 f9349064c7c8f8467cc12d78a462e5f9
- SHA1 5e1d27fc64751cd8c0e9448ee47741da588b3484
- SHA512 3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf
- TLSH T1B2417B303131B4D84D826F0215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7221F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 21KB
- SHA256 36676c0c90e9b16e7490abfe7dc4d23411e241ea7b4941319140c7e1ccb52d96
- MD5 6ea66c3609fab5be15c59830eaeaee4b
- SHA1 5eb97f08f34451381b99578fd590cd65db2f8a64
- SHA512 dfcae6f1c03940bdfd49a168a20f59e443483e87022a214444539f46e4ab8936645ab6c130dd10b6bb7806efd7a9eabaa4d12e3c3c7bee6505738bdfb37722eb
- SSDEEP 384:ctfQDTMyazb3O/mp2Gcs2dk4ZcouXZR/idYSCm1JkCwve53lLSzHIQW:UfcMyob3Hz2eIcou1+ECwA9H
- TLSH T16DA2C83561B74DE9DAC115B0559E0AEEFFE0DC419BB832CCE72DFA1D4CE293A5620064
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 21KB
- SHA256 20b2ccdb71c2e8cdd431d31e25f6c004bbf92a9a0f0fc490fec8a436ee9dc8eb
- MD5 6fe24d7f45f9c38791e8d0528ae1cb3f
- SHA1 1ce54e6e44c67c79bb4b34af62f41160c13e274b
- SHA512 30f861eb285d35a5d23f3b2f84c111d53ff874251988b691873d315d8a6a2e280da35378e8d8be91fdd2fec05ac83bb4ab4b79d04ae956810e716f6deb52d560
- SSDEEP 384:dhQDT9POnx8fTw/NH4jRscXqMhKuSm787Hk7GVruov5ha54fa7g4Zu:Lc9Pox878wiMWpOGtuoBwmv
- TLSH T1ACA2F72D76EF8CCEC9C564A1458A8796EBE4ED5193A161CEE70FB90E5C8783C96100FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 19KB
- SHA256 cf1179b08f723b0c7c374233c0d2313b32346a351d71464e321cf50dd9f3bae5
- MD5 5a08c4cc54764e855021a13138c104e0
- SHA1 19320e4503cb79624d6df9e8259db00dcfd4b818
- SHA512 3e154a725114f08ce55bf71783b4cecf59290c77e229587055535732e89de90b5306309e937d8814c73e2f00f02ecc60c3fd9b5f22a831a903972503bdb7da06
- SSDEEP 384:zhQDUakL1dFtudtcXqMfzQRmG+7gZEkA05uetJ5BUu:tDTLHFkNM7K8GF5ueXp
- TLSH T1D992082961EB8DDADBC068B0459D4B9EEBE0ED41A7B072CDE71EB90D1CC753856600EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3524.tmp
- Size 588KB
- SHA256 ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2
- MD5 a9941233b9415b479d3b4f3732161eab
- SHA1 cb2d99af52b3b1c712943b13e45d85c80c732e57
- SHA512 cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7
- SSDEEP 6144:waFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOlKmN9ysU5pvs8g73iK:JYL9HXVW0xOA+KlZC4vA55s8g73iK
- TLSH T12FD44A21369AC036D56D05B02DACDBAB516EBE760B3658DBA3D81E7F84F08C25731E13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gx3txkh0.sg4.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Pictures\DEnstV5U
- Size 319KB
- SHA256 8a0c881038a027b07e33f85762cc79822225d5835c8e48170321b8d2f69fa2cd
- MD5 5b84507bbcb73dd50d7511fb4ccbd510
- SHA1 9d234402dfef91d10546f63ab0ac3e411c59b0b6
- SHA512 8b3da0d93175ca5dfaeba01d00228598ae91e8a318b62586a853db6275bd7ecfc8541038d8825aea1c5e47c1e6c5443c02632f733afa326e81d3f129efceec12
- SSDEEP 6144:+bnAFK1yE/tTXKFI8FI7NvGZi4DYveBF4onbIv/Bd9sm/ZmHlRpFCO:EnAFKn/tWrIsZcKSon6dXBmTpFn
- TLSH T1E36423D321FDAA523517299A164047FC90E06ECA2FFC251F35B2CE8471B4AED86356B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Videos\_2
- Size 345KB
- SHA256 8872845a931fc209fd401b21aa42313a8f0b5381e14ef107ab5ea49ed5abf24b
- MD5 890fa1f3407b9f2dbdb36d752005615b
- SHA1 f5baf9081d69940f19b513cf86dd70f2552f215d
- SHA512 41d2aff503a9f0bea9999c71eca52c3309e58fc55cb77df6b29f5546d16d020c7d66d06bec8bd52d76ded1b0b705d915e706e7176654514c5a98a8325529bc57
- SSDEEP 6144:oYnHgHDWFntwakU6q5HwkdT7uBmCI5tTueAfPYhpwW8fOC/DzcWVTpEDZg9nOv6I:oYnHwDWFntwakU6q5QkdT7kmCutTueAi
- TLSH T13A743F4B1376B3E8255040E94AD478C22EFBD5A32F2D717EB772C883E41E93905E9768
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Videos\install.ini
- Size 41B
- SHA256 1f18a53140d3b9816674db2475045fb49b1d72c80c3027d99a60df0554bcf8d1
- MD5 e1d09e89b8f956360191c831a74dd039
- SHA1 71b84b9a06e84c619fe81b2e1b1b42febdd9fa17
- SHA512 06aa4e3d98fcdb624cc20c907c45ba60b34173d63f6064ee1bf1f402a0dbfad7a68a02e9d0e1046dc58e4ad4bae1e8d715353285b72c5e54d4f25bf3ce86deba
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIFABB.tmp
- Size 27KB
- SHA256 7642cb37162857e082e7f058132cfa59eb7c38abeefffaf54dc58443defef0c0
- MD5 76058e568e88720b0378969e6f11dd3a
- SHA1 7d9fcb3779986a32d615f3ad0f1fc1c248cefd9e
- SHA512 7e46940e83231895163eb75061d0b23e4d69accaca66171e957f065f6535a9a95b43b006a36e5b3d7e596562d12693c617dcfbcb966dac2eda2b9eea714f14ad
- SSDEEP 384:+AmA+aCzYbFLsyOukR1FVCurjmygqygHvZYLX2Ip4dOqjdAA1m5wMvaSu7wSh1T:iLYbFhOuMW6HRYT2Ip4wqxf1mlv2Ue1T
- TLSH T1CAC27DC6DB780263EB432B30D3E9E983B57977C3579148EF68AA905509023D1EF39639
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.0MB
- SHA256 c0f29730f8a8ed8a6b30c9da3b4fc9bb343287c3d8bdb04616fb98ff4caa7c51
- MD5 994a6d78d24ab69b21cd0d3f55f01236
- SHA1 09b716d5c2764748e2c84dc818d8efa2c0915bce
- SHA512 e4cfa98a5fabd4629534c5624d977dcd56a10d6616b7c82a932dd455142d3b31f181cf47f6fe4ded87550d988efaf1cb2f519c3e5c022cc34da5a7c75ede38ef
- SSDEEP 24576:sEpmg3MzdoO/vvTLDtfuFJ2xn87xyXQ5Tf4N5TjtcqqDzWRvI6MmaThUTI:wg
- TLSH T1DB47D52477F92100F7F79E3CA8F06A6359397D5BAC16DE8D05411B4E0822B71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{3ab63b48-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1940fae3-e714-49ee-b86c-e7aecd56d989}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e3816b79285075062c62ac7808e381cddc892cd0aa5955eb818d0ad16942834a
- MD5 5b86384c18226b29c0a0fd09828ca873
- SHA1 ecaeba0a02b6868fc57ceff62e932e0c7b0982e7
- SHA512 b0290c882331acc6e0cc3355b557a118fc78bd56fcdf658e2e9367d384115ee9677805a584cd1099b44c0c5bdd69a9eb30152342733feef06661534e5f259d82
- SSDEEP 96:FhSs1yvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:3Sxb++ZVm
- TLSH T1D4D199085AF54711E2B3AB3129F18553A877B811FF33CB8E0298638E2671910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH