Analysis
- max time kernel
127s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GoogleBrowser_Isyi10_v1.0.34356.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
GoogleBrowser_Isyi10_v1.0.34356.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target GoogleBrowser_Isyi10_v1.0.34356.msi
- Size 95.3MB
- Sample260717-pgldfsav6n
- SHA256 c5d87b2fd77b79c04e3cb70c08c383cad28eb8435ffd6a3eed1a9c391b6f83ca
- MD5 0339c190d049e564aca4c1fd58763a09
- SHA1 a2ab178de12f8a951e1e3d7425e4dbd46ffedc26
- SHA512 f324e446a1fd3aa68c1fc40d700c24fa26b31db077a361150e9379f0e3b0dffdaf66f9639ce75e8ef34b3ffe224b8ac422b4d7bccaee010d7fbf7f65920644e6
- SSDEEP 1572864:RRIJx/xzKqEvlacMJp+mF9k265mjkcXUw1V034I/KDjZLhI2mZD4rLZ8bR045caN:8x/xmqEdanp11Nk2x1V44I/MZ24XZ8xN
- TLSH T157283331B11764A4E11FB7BF9178AF8980317D92732BA59BB3787FB28571A8310B1943
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 2 IoCs
resource yara_rule behavioral2/files/0x000c00000001c5c3-78.dat family_donutloader behavioral2/files/0x000d00000001c59d-169.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2832 powershell.exe 5608 powershell.exe 264 powershell.exe 5496 powershell.exe 5792 powershell.exe 4356 powershell.exe 432 powershell.exe 2716 powershell.exe 912 powershell.exe 1568 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\QKARDrv.sys xwizard.exe - Executes dropped EXE 1 IoCs
pid Process 5804 QKARDrv.sys - Loads dropped DLL 10 IoCs
pid Process 3952 MsiExec.exe 3952 MsiExec.exe 3952 MsiExec.exe 3952 MsiExec.exe 3952 MsiExec.exe 3952 MsiExec.exe 1180 MsiExec.exe 1180 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe - Badlisted process makes network request 10 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 428 MsiExec.exe 6 428 MsiExec.exe 7 428 MsiExec.exe 8 428 MsiExec.exe 10 428 MsiExec.exe 11 428 MsiExec.exe 12 428 MsiExec.exe 13 428 MsiExec.exe 18 428 MsiExec.exe 19 428 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 428 set thread context of 1544 428 MsiExec.exe 118 - Drops file in Program Files directory 32 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\win_utils.node msiexec.exe File created C:\Program Files (x86)\Google\Google\ybb_Setup_v3.5.24243.exe msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\Herms.dll msiexec.exe File created C:\Program Files (x86)\Google\Google\elevate.exe msiexec.exe File created C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\mac_utils.node msiexec.exe File created C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\better-sqlite3\build\Release\test_extension.node msiexec.exe File created C:\Program Files (x86)\Google\Google\aboutIcon.png msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app-update.yml msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\win_utils.node msiexec.exe File created C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@jasonscheirer\native-progress-bar\build\Release\progress_bar.node msiexec.exe File created C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\j.xml msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\aboutIcon.png msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\cf-prefs\build\Release\cf-prefs.node msiexec.exe File created C:\Program Files (x86)\Google\Google\app-update.yml msiexec.exe File created C:\Program Files (x86)\Google\Google\Herms.dll msiexec.exe File created C:\Program Files (x86)\Google\Google\res.png msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\emjio.tmp msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\elevate.exe msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\sxx982j9s1.xml msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\better-sqlite3\build\Release\test_extension.node msiexec.exe File created C:\Program Files (x86)\Google\Google\emjio.tmp msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app.asar msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node msiexec.exe File created C:\Program Files (x86)\Google\Google\j.xml msiexec.exe File created C:\Program Files (x86)\Google\Google\app.asar msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\res.png msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@jasonscheirer\native-progress-bar\build\Release\progress_bar.node msiexec.exe File created C:\Program Files (x86)\Google\Google\sxx982j9s1.xml msiexec.exe File created C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\cf-prefs\build\Release\cf-prefs.node msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\mac_utils.node msiexec.exe File opened for modification C:\Program Files (x86)\Google\Google\ybb_Setup_v3.5.24243.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\e59ad5d.msi msiexec.exe File opened for modification C:\Windows\Installer\e59ad5d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB9A2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBB48.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFB256EFAE9C2E5FAF.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{EC8E75B0-390D-43AE-8117-9DF715AD4EA7} msiexec.exe File created C:\Windows\SystemTemp\~DFE219A4DD75A4D6A7.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBD3D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC201.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0A3753755CD7FA41.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF80CE5F8B3526FF7.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3872 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4608 msiexec.exe 4608 msiexec.exe 428 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 432 powershell.exe 432 powershell.exe 2832 powershell.exe 2832 powershell.exe 2716 powershell.exe 2716 powershell.exe 5608 powershell.exe 5608 powershell.exe 2832 powershell.exe 2716 powershell.exe 912 powershell.exe 912 powershell.exe 432 powershell.exe 5608 powershell.exe 912 powershell.exe 264 powershell.exe 264 powershell.exe 5496 powershell.exe 5496 powershell.exe 5496 powershell.exe 264 powershell.exe 5792 powershell.exe 5792 powershell.exe 5792 powershell.exe 1568 powershell.exe 1568 powershell.exe 4356 powershell.exe 4356 powershell.exe 4356 powershell.exe 1568 powershell.exe 428 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 428 MsiExec.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe 1544 xwizard.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3872 msiexec.exe Token: SeIncreaseQuotaPrivilege 3872 msiexec.exe Token: SeSecurityPrivilege 4608 msiexec.exe Token: SeCreateTokenPrivilege 3872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3872 msiexec.exe Token: SeLockMemoryPrivilege 3872 msiexec.exe Token: SeIncreaseQuotaPrivilege 3872 msiexec.exe Token: SeMachineAccountPrivilege 3872 msiexec.exe Token: SeTcbPrivilege 3872 msiexec.exe Token: SeSecurityPrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeLoadDriverPrivilege 3872 msiexec.exe Token: SeSystemProfilePrivilege 3872 msiexec.exe Token: SeSystemtimePrivilege 3872 msiexec.exe Token: SeProfSingleProcessPrivilege 3872 msiexec.exe Token: SeIncBasePriorityPrivilege 3872 msiexec.exe Token: SeCreatePagefilePrivilege 3872 msiexec.exe Token: SeCreatePermanentPrivilege 3872 msiexec.exe Token: SeBackupPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeShutdownPrivilege 3872 msiexec.exe Token: SeDebugPrivilege 3872 msiexec.exe Token: SeAuditPrivilege 3872 msiexec.exe Token: SeSystemEnvironmentPrivilege 3872 msiexec.exe Token: SeChangeNotifyPrivilege 3872 msiexec.exe Token: SeRemoteShutdownPrivilege 3872 msiexec.exe Token: SeUndockPrivilege 3872 msiexec.exe Token: SeSyncAgentPrivilege 3872 msiexec.exe Token: SeEnableDelegationPrivilege 3872 msiexec.exe Token: SeManageVolumePrivilege 3872 msiexec.exe Token: SeImpersonatePrivilege 3872 msiexec.exe Token: SeCreateGlobalPrivilege 3872 msiexec.exe Token: SeCreateTokenPrivilege 3872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3872 msiexec.exe Token: SeLockMemoryPrivilege 3872 msiexec.exe Token: SeIncreaseQuotaPrivilege 3872 msiexec.exe Token: SeMachineAccountPrivilege 3872 msiexec.exe Token: SeTcbPrivilege 3872 msiexec.exe Token: SeSecurityPrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeLoadDriverPrivilege 3872 msiexec.exe Token: SeSystemProfilePrivilege 3872 msiexec.exe Token: SeSystemtimePrivilege 3872 msiexec.exe Token: SeProfSingleProcessPrivilege 3872 msiexec.exe Token: SeIncBasePriorityPrivilege 3872 msiexec.exe Token: SeCreatePagefilePrivilege 3872 msiexec.exe Token: SeCreatePermanentPrivilege 3872 msiexec.exe Token: SeBackupPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeShutdownPrivilege 3872 msiexec.exe Token: SeDebugPrivilege 3872 msiexec.exe Token: SeAuditPrivilege 3872 msiexec.exe Token: SeSystemEnvironmentPrivilege 3872 msiexec.exe Token: SeChangeNotifyPrivilege 3872 msiexec.exe Token: SeRemoteShutdownPrivilege 3872 msiexec.exe Token: SeUndockPrivilege 3872 msiexec.exe Token: SeSyncAgentPrivilege 3872 msiexec.exe Token: SeEnableDelegationPrivilege 3872 msiexec.exe Token: SeManageVolumePrivilege 3872 msiexec.exe Token: SeImpersonatePrivilege 3872 msiexec.exe Token: SeCreateGlobalPrivilege 3872 msiexec.exe Token: SeCreateTokenPrivilege 3872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3872 msiexec.exe Token: SeLockMemoryPrivilege 3872 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3872 msiexec.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3872 msiexec.exe 4608 msiexec.exe 3952 MsiExec.exe 1180 MsiExec.exe 428 MsiExec.exe 1544 xwizard.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4608 wrote to memory of 3952 4608 msiexec.exe 90 PID 4608 wrote to memory of 804 4608 msiexec.exe 96 PID 4608 wrote to memory of 1180 4608 msiexec.exe 98 PID 4608 wrote to memory of 428 4608 msiexec.exe 99 PID 428 wrote to memory of 432 428 MsiExec.exe 101 PID 428 wrote to memory of 2832 428 MsiExec.exe 103 PID 428 wrote to memory of 2716 428 MsiExec.exe 105 PID 428 wrote to memory of 5608 428 MsiExec.exe 107 PID 428 wrote to memory of 912 428 MsiExec.exe 109 PID 2716 wrote to memory of 264 2716 powershell.exe 111 PID 2832 wrote to memory of 5496 2832 powershell.exe 112 PID 432 wrote to memory of 5792 432 powershell.exe 113 PID 5608 wrote to memory of 4356 5608 powershell.exe 114 PID 912 wrote to memory of 1568 912 powershell.exe 115 PID 428 wrote to memory of 1544 428 MsiExec.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\GoogleBrowser_Isyi10_v1.0.34356.msi1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3872
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CA6DAD7E11A3EC02C7FCF23D97336A9C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3952
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:804
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F6AC8CCF32DA1836DE5C69BA1C45D9502⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1180
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 87784ABA3E3844B52881A80994A609252⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5792
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5496
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:264
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'xwizard.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess xwizard.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'wuauclt.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess wuauclt.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
-
C:\windows\system32\xwizard.exeC:\windows\system32\xwizard.exe3⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5680
-
C:\Windows\system32\Drivers\QKARDrv.sysC:\Windows\system32\Drivers\QKARDrv.sys1⤵
- Executes dropped EXE
PID:5804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ad5e.rbs
- Size 29KB
- SHA256 4f0e019472928cc864e30a32573a9e8f1bbb5a2aafdc0eaa83ea78dc60d13720
- MD5 24bd4645c5e59de9f63f7aca50219623
- SHA1 368dc3122336576a9c55fa50bb5a5c82d13bff5b
- SHA512 f8b378484350216a07474213f41d097bfcbd8797246dd19ae6fbf9664c1fe8b83dbec11f777d3c2413ecb9c13d5d8ccb2a6960b2b10c64534c8c999d8db99a5c
- SSDEEP 768:MYoRw42UvXVoSS0rfyjfj44VbvDQe/PrnPxWE50:toRw4vXVoSnrfyjf5brQ0rPxc
- TLSH T150D26D436AA559C6E137C57277968912FA3A794093A04AEF1B9CC26E0E93FD026FC710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\aboutIcon.png
- Size 1KB
- SHA256 3bdf39f14da6dcbcd836ef6b343f3363e7c1bb841df11e4f4339acdba0ea3cf2
- MD5 7d89d1fce3f39185fc81a72e6965722b
- SHA1 0947a15b591553e933cce3e335d6fa6a4f5842aa
- SHA512 b3985f3e3cf8e2050cbabcd6c19205ab1d84c2afed0fb60d35535d9e3ba68fc6597844256f48f606d463f589abcd5147ec22a1362db0f46a7cf56c6bd4caa0b7
- TLSH T10221D8828DCE3F6B8903D96517D1048950ADB28F6F7E1A51A780DCF6B3A387601948FD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Google\Google\app-update.yml
- Size 157B
- SHA256 b85c3562f1972cc6c8d5622200f37b07b9b8b80a9faf63103b2554eb5d6f8524
- MD5 0d100381da4d184f55088821b532b77a
- SHA1 93c526e5b8096b517ead68246b0d2cd6e4c5b3bc
- SHA512 2b7d9abe8cbe579b1a9c0ebccbd5e2d49698fef621e67bce36c40fee8b043e213e4201ff0f3fce7548f679d00b3786b2055983f4eb4c98cc4fb34f5e21aa95a0
- TLSH T11EC08CA9C300C06013231971AA23DA20E6ABEAE7C1C540AAE2CA80888122422A65B58C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Google\Google\app.asar
- Size 8.3MB
- SHA256 4055c6b910380de1d3126c45fabf170c2927d1dff32e5507394f37d2f7988229
- MD5 b560a0cbf14d0f89846b5932e57b1706
- SHA1 1dd7c7d6b5b3ca29bff0080add2b2a3bec4c5c41
- SHA512 542b002997a313902898d4f2a422d51975de6719e4376ad14e24e4781f13f8a616279fd2012fa660d2baf4fa5b6b5cff200ce8ab43dc4cca527fe76dba58b6c1
- SSDEEP 49152:x2p8pbPyRVvWb6lbbaWkt6y4wV/Vpml2Em06lxSEXIkTcOOeS7EEMUWlIyiLZK8S:lDBe+Bv
- TLSH T1E4966B6E3E81B5310773A2A2817FA106F3791C1B589CD490B3CDE5A82F844AE9177F79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@jasonscheirer\native-progress-bar\build\Release\progress_bar.node
- Size 457KB
- SHA256 c763309360265048d8d11c9997664136da68f490c9b67f20e506f2cfffc01568
- MD5 4c5f31427cff66c5f150f19cbc1fe9f2
- SHA1 be4bc060502e775389c8a7225e0be5c475178a3f
- SHA512 65c75d0ccd231a14bb3870fda27729fc74fe2ccbee680d5dd84928f98b869a67d453521bcea374da3f1aac6d07aa13df85ec0bd3a11516865fa59c4b4b3f6a4b
- SSDEEP 6144:H9GEXPDpt7KSZt5b9xCy7POnCn584fRzdrKG4/VarjsyC:H9H9ZtB9gI7RBmFbZ
- TLSH T182A48E19A76841B9F1A7D174C9534907EBB1784A1370E7CF43E0DABA2F637A0563E322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\mac_utils.node
- Size 116KB
- SHA256 d92136166be2103db478674e6c5981c46c09c8822b7aba392ed7226c9d91cdda
- MD5 1ccba6f0effa618ec88ed2496aa1310f
- SHA1 c9ba7183053888ba56ad91eb7b5657920dc51bc7
- SHA512 8c3b8aca65bb5bb9b7bfe60b03b71cb508b45e51bb0b3f72a3cfecc6f3147039b83293f9c4b9a62f7de79381dc1b03770eae6bd0fc0071b7c88e88c98c8a0d49
- SSDEEP 3072:PJcu6rRcm078R5vQJwMQJNFVNJxVNVNDdW8Hbf+qD5qTOd:G7Rdn5Q+MQNHa65qOd
- TLSH T1E6C36D9B62B900BBE5B38674C8A74E45E775F86207608BEF03A4425D1F233D18E39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\@notionhq\desktop-native\build\Release\win_utils.node
- Size 379KB
- SHA256 c6d841ebfe6701bc2006ebc4656aed4fcda9d0d50801183b0442bc8e8f42be5e
- MD5 0ee9a99b97c33382ef7c199571663868
- SHA1 da654889044dc156a78792dc3544ec867ba9733b
- SHA512 058b7ac51e5218ea1c7ca05d08b47cd47323d3b1ab56a0ce72909c79e58cef93d8d3145a4b7e180cf691635cc099bdfaeb1f9d9590da353adb7808943b467348
- SSDEEP 6144:aeEFLGIGFeA0POtaNxIbeGfHLAaMzKYPtarr81q0QB2W3L:ae1eA4OgPIXfFMzxtaP
- TLSH T1CD847D1AE6A405B5D1A7C578C9734903EB717C8A07709BDF23A14A9A1F33FE09A3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
- Size 1.8MB
- SHA256 9594ab007033706286097f07a40ba16ab6b84b576114b8cf3b518115a85e178e
- MD5 c50b8698894d602ad22f1f4cac783b62
- SHA1 de529ab0fad74e116c691c56d7bde0b1427868bb
- SHA512 b22d874ef7cecdaec2991a4b183a1a4723581e0672779257a0e3a4ee143885a736d6e219d81193dd5860b85971224c2df08aceb6b2d8a941cf4d00ec6f84a305
- SSDEEP 49152:OR1qcrC9lX0E3FIwvjl/6qoWEGKgBiJ/00abedXv2OCh:OPqcrC9SE3FIwv16LG
- TLSH T145958C4BB3B400BDC1A7C0B9851B1A0BE776B40517749BDB1590CAA96F63FE217BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\better-sqlite3\build\Release\test_extension.node
- Size 116KB
- SHA256 3d49d9dce23fa6d03f4d0fe45678b8b3c7fadc3eedbd6d748637c1fa2c13e150
- MD5 20b9b5b4ff9cf06ca3def6d016eb16cd
- SHA1 edac51c9296d92e62824c1140015bb4638e054aa
- SHA512 0d2191a4eef417e9c339c0b903dc8412e4f9fe08e23630a8d9aaa5cb2952f4ea776c78c9280af100988aa2a17ddec2c39a269490e86beee04caae3aaacde6305
- SSDEEP 3072:u1XvZ+CiNs0hufIkLCaTJNFVNJxVNVNDdW8HbPUjnQ:YjUslHLNTNHEQ
- TLSH T172C36C9762B500BBE1A38634C8A74E46E775F56217608BEF03A4429D1F237D18E3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\app.asar.unpacked\node_modules\cf-prefs\build\Release\cf-prefs.node
- Size 116KB
- SHA256 a269f733e5e787e26191ce09098acbb9d5125e36b3d575349fbbdbb77d3d3943
- MD5 59f1a05282b20d5b16b0bd346349e966
- SHA1 47696839372aa6a45ea1c5dabeacf874c80a26bc
- SHA512 e28df5f85a746110a8d809258c1473709045611b7aa9a5ce15009e44c9f1a953ea0b706edf2f29907a05d1b8deba68425a8f0c0d5efd8b94c02f38a9711953e5
- SSDEEP 3072:2Jsu6rRcm078R5vQJwMjJNFVNJxVNVNDdW8HbvbQDQsh:77Rdn5Q+MjNHv8QQ
- TLSH T1B9C37D9762B500BBE5B78634C8A74E45E775F96207608BEF03A4429D2F237D18E39B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\elevate.exe
- Size 120KB
- SHA256 f24215b176aa907f56c3ef3c9fce06fbddeafc1e56cca7042e202b30b30598eb
- MD5 9f02aad6c5c664672094d1dfb240d0bf
- SHA1 606d579b773220922d87cfb5dc340c8d6bf794d4
- SHA512 667ed1cbde697cd2a70c1a393c3baa28c947d2fd05bcfa3bc64278f6f8c6e193ac62aa637752bdd05f8f61ab3bd9e3d93cbfa3e4fbbd2564539fbd06c4b7ab16
- SSDEEP 3072:MpbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlh7:QPrwRhte1XsE1ld
- TLSH T157C38D0174C0C472E9732A3555B4CAA19E7DFEB11E749EAB2398127A4F602C0DB29F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\emjio.tmp
- Size 401KB
- SHA256 9e74b0e2c8683ad6fa3a7e59b2b11b680c4a40d03b76f3fcab40ac3a788e84bb
- MD5 7df197f014833d4501770d9422636b4a
- SHA1 209a049f4fb86ef31f638f64c8e3dbf1d5d4c78d
- SHA512 c867e377a4c79d5f84749cb0161c6d617d008ac3696871bd0729b0682fc856e0ce06494f7e3fd5c538b50c8d1d88a4eeb1f3ee9b6de8c7c50d0b8aacad1f23a6
- SSDEEP 12288:Ec6V6nTKp8fw/TxvFDouIDTc9z7kUcflrvQi/Al:BnTKpd/FNDoHeHcNIl
- TLSH T14A9423E798F1AAEBAE51815CDC3AFA31CEF238572036BA5A6501EFB65F17411670D300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\j.xml
- Size 179KB
- SHA256 ec9e50947af0ae9ce8daf7d517b5eb9f7a9ac2f2706cea8888c372ba800deae3
- MD5 faf29e7f890b8f77f9064b9d3e067c34
- SHA1 8480be9dc83c9acff354066e5d94e3159eb89e06
- SHA512 31a22dfec572207ac0c16277baa72a45b53ba1e85af6ba5861dd71d7212079377e2fd995bae543a20577a765beb30feaed4c3451b8dfe64bf8af7922534d573f
- SSDEEP 3072:rSfiqikCiSqafDE/nqx1rLIbRmc5gCSaFvXdBpNbIREONX53dUZcJu9/yjgc:wiMafY/nqx1Idm4ZzPlNbIywX5m+u9q7
- TLSH T1520412F3A574C6AB8E58C011E9AEA337EA57348F273F92CF0E19C2857AB290535141D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\res.png
- Size 346KB
- SHA256 eae560da4b27e625d5b03f4237e9085d24045599178a07120045b784448630a2
- MD5 0cf50aec435caaf6d9332a73d506a657
- SHA1 e77d216b8e0d97ad64ab970c95478c48395f3419
- SHA512 ba7021b7076f819548e07b64665a8057bcb9e17be6c9aae9e34badb783c84b891a33751026958ae7b5ad2c2d4e52076295a64d86ed8400937dfe5ca330f4b2e1
- SSDEEP 6144:sarLNxAtu7sKUj0sxhdeKOi51pblbKC7hdQw+1bhW/QT01viTUF:sa9RIj/xHeKOipdQwYtv+ic
- TLSH T1E574F17BC290439CDFA641AC5D8E93E24246012E7AD98C49E01F9DE5FA978FB07D0B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google\sxx982j9s1.xml
- Size 14.4MB
- SHA256 0ce58807af5583524880488027151578aebca9b379b673f5d1b0edec93847094
- MD5 1fefe40eb4e6e7f04f46dd7ff6048c34
- SHA1 2a98860b9e7c57e569e75f3713dd49f978e44dd6
- SHA512 51855ea9b10408250daa61f45088c74ddf450954a2267372eaf4a49368d21d97fac21cfaa67d73f19f6bd2f59a32dec70ae630a45251925e22aade2f7ca82b38
- SSDEEP 393216:C/+ZB97MLNPkVp4Llk3ltuRytvNBFSXucknFQrvTtq+7/TcFZWQDc:CmZB+L5GIultuRgllqrvTtq+H4w
- TLSH T1B6E633B7F90238C8B1C2B2821B00DE69B758E72FCC6939D9E66D5672513D8F90E5DD20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\aiview_btn_next.png
- Size 7KB
- SHA256 18b061897be28facb38f53afbf81a62796708c93cf7e885c2d77e4bd739d4058
- MD5 ef0b892781234504a0a975d113afe4b5
- SHA1 01d3851ed7b3260c891fcddda9bf6f4f0f431ed0
- SHA512 006eab9bdbca144c523aa78f65fdec441263bfbb598e6ef66f2328d768e8f2c7cf04e2d8a5d9059d9c29b4081a148d4b478cb5a30a085414c8d3f1326d577a05
- SSDEEP 192:9eVYHKTL391sHtbSCBdI93B2PXcHae1BXLGZ3FkhT2/GIdctzBK:wcKjsHFS4M3B2PXcHx1BbQe35tNK
- TLSH T13BF19E8DD1FEB2703084253A001376DCDB07AED917E09A094575C23B7D7DA535A6E3E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\app_bg2.png
- Size 2KB
- SHA256 1a10a51a9cf29c82e6405483535f8ea1365abe07eddf215949f250d18bfb53d4
- MD5 28f7363d65f989da50a9f7d522ccc0ae
- SHA1 0170868e399de1d29ccb8cb089a07ca3a982fbaf
- SHA512 ba744b6b7e05384421f178021d79517b13b7968b57f951b87b9a4bd89d7bed9f8a5942c1b74a1658d45aca7af9832c6081567ab4396745bcf327af80e43a2d84
- TLSH T177514D8D5840491A100E0BBB356BDE068977EA9043696E0C9DFE824FCA20C513D75F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\app_camera.png
- Size 984B
- SHA256 dfeeb01f1c68c3979c29ef190d2980b7d1ffc3b635a1e9b2217f172bd9631e79
- MD5 2b0b891399f0d956f579bfef3859b1a8
- SHA1 b888edfc3aa17675af9cf018466df4efa0015887
- SHA512 29c7ab8f86c208eea4f0f7bd3e0475edaf9df8515a82894e8b5aef9047e2fba7f595dbaa9520d13453155bdc88cd8a7bbd1537ad9734b0e8e30f5527d5cf7b89
- TLSH T12F11CCC17C5F4D644D343577A8CB417AE47344689D876125C13B6C93F3532C70017B56
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\app_honeyview.png
- Size 776B
- SHA256 372bb27951bae9884437076587f31fafc4e10dbc43837eaacf463585f8e10adb
- MD5 874db48d6af0af72f75dc048a32e1a81
- SHA1 46740440a5c81ef5fe50997dbc8d638f16b8a09f
- SHA512 f1d5569138de7c1434daf2d6538fe486bf738fdac73dd7d94d23e899c9140e53a777cf2fbcd8e16ddd929271cac25510692b136f29276c850d056c2a4b963906
- TLSH T13D0120D792E040281B75252F238C5A32E4B3EA90983B3D5960AAECE90B397648411ADE
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\app_wooting.xml
- Size 283KB
- SHA256 211558b8ef007dab0b7dd107a0fb614f497012d50a208e43c4fac1deda8e906f
- MD5 77567127ac17fdf920256f58aa0f16bb
- SHA1 a7324dc4c39e73d88a5da2ff4a037cae7aa2bc35
- SHA512 503de815bee68bc4b2f157a976569c0918b36e11e10a161d35cc12b0898e02b36859818f51f8138785581ebe136a78f81eed1bad17abfdf15022c7cbc0eb1aa6
- SSDEEP 6144:AVmplYV/hN5E9M18NBeleBnFYTXhUkXsO/:AEplwNn6BDFYTXhUkXsU
- TLSH T136549D7F8158D73E62E095F733AFD1863003E93F915601B227B4A642A6CC70A56FB4E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\resource.h
- Size 52KB
- SHA256 7192f0d66300464f1acfa000427cb35ab8c8ea4412bc35a984a79767f0e4362d
- MD5 d3036ec2de826267ab8a51a5e78bcdbc
- SHA1 39d8f82ae28cd74cca1e49f701e20b6cada65301
- SHA512 e11253a63678fbbc074cdd64aad6e2ecdd64a12132f93a0d8884d0f2bd87b6e9926df03f66185309c831e014a484836fd934068c114163440eef296a2f4ec015
- SSDEEP 768:t9QakBa55OjL2HFYWS3eSwtGv07bwtm46/v8U3TWjLWC1TNKSq5ZUq9tEt6C+idk:fXkA55OjL2lYWSIFJPChgbBltSD0cRq
- TLSH T15E33980C4DC769DA94B8F548966D87662099EC331DB958ED326E2D8C4F281044BFB8FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\skin_compress_dlg.xml
- Size 1KB
- SHA256 102872f03444c239335280fb500ee0fc7e2b0be17035f115ed2d367537cb4a6e
- MD5 b43ad7ccaadc3baa5d96273ca6a76066
- SHA1 4d61e83f582d86046ec55460a2ad26a67d63e312
- SHA512 c0d479b087e1f6113d52f583410f2c3bea95733762b739b1262c8ff505602ac4023de40672fc74fe3af54731b762d6a2d52e229c04fb4627c031a1f4eb8abcd4
- TLSH T1AD310A4326EC2118B1A6BB85ABAA80755B25FDD5522ECC7D24A11D0EC4E7E903902FF3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\skin_main.xml
- Size 26KB
- SHA256 0d0f42b5a3df6c24f19bfda31d0be026433ca63b31eb6bc8985cde38d8f4f42f
- MD5 6b7f9bce2378d3bed590deb81682243f
- SHA1 ac645805e5e7fb972fd1faf1781d596c2fdc6e73
- SHA512 a7b33b30b3b7fe690ec06091abb3e04abaf43c80854ff9d7c96408e7e772587035907ce163cf9ca67b569f5b6671e4b855df59b69280319b9980a34a5713b121
- SSDEEP 192:mgqLaTs8p+wur8vJ0Atbeb8zd7vGucgSPAOLbzQSALNbLdfzSJ6+Z4jD6aJz4zq5:Tq2ppur8yESb8FeiBpl14sddbANDy
- TLSH T13CC22F54AE2A3A21C56641023B724B85CEF55C33EBD45358FA0F1DABAFF7548036336A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\_Caphyon\skin_select_folder.xml
- Size 3KB
- SHA256 f8e78afa6de39ef866ebfc802909d1e993d642bf9d35abf1fe63076c3d081858
- MD5 a377159184c58012d5d1f7cc1c2b5882
- SHA1 b1d62b7030054a816a654058bbba8ea180c924b2
- SHA512 2af832e0da0277292ec46ef9f302db8bad88940e291e6fa1c74e544ac429f607d3a24260ec172b2f1f2e156d3c88b7540ee73aadd14c0f60738baef6cbc661b7
- TLSH T16571465367ED1528B1B76A98EA7A81214E27BC95253EC85D209C2D0C8BF3EC10943FF3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\_Caphyon\tb_btn_test.png
- Size 1KB
- SHA256 18ea74a7bcea8bcff40c960f74c4c4c5b424458bccebbe5149be6423de3efd2f
- MD5 7217a347c78e75e9e585a23ce8d8823a
- SHA1 fb760bdfc697d807b544b621b68f0ff4fb9dd4f4
- SHA512 d9a71e3e3c2b64be07661bf91a302d22dc2c01cac9484416d1e456c89bee6a4080963bf34dd51f4cd5919d112f8cfec3dd0299df9aabd47c543cb1f8464fa045
- TLSH T1F631C6E0B3648DA9343E914B8277C989CF33805B6DF10A08B9E09EB15A7758E4B655D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 d92d529483d3340105c18086873cfbbc79ba2585fadb31c73c908545abc1f97c
- MD5 3b20d8907f8fb0ef3fab55d52562262d
- SHA1 ddb6693b9c25c3b647f7ab6f44715bef31577d49
- SHA512 258d046884aa7d4d5f1dc90e617ba880c602d53bf576809be1dde22b9a886f6a0182b90a95eaf9904957b8dfa9c44f2620c520b93c9cb40a7d9dc73cec4ca6d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
- MD5 acbc65123954839a819fa2495d239bf7
- SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
- SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
- TLSH T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 95daeb8c6c037870e9eeaa97832a7dc3f7f6a7782d926fed109f7eb9bf69d6cf
- MD5 de070647138db10f2e60e9fc422a5a53
- SHA1 1396ee1d7b8ffad56821587bc509ee00388d0241
- SHA512 07bc34e2a8ea4cbffbdac5aeab0ba0c36f297a91cc48c97e8c95e13c84d5e4f3cd4cc0204a24ae949e6ccbaf813e9ab7b8654d1edbb0857f7f8ffb9b0d2e2380
- TLSH T162219833B3DC8210C89A013A10CDAC1036B6C7DB80DECFAB7B84E659A43F699CF61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
- MD5 ccd060f9f366be151fe026216473d89d
- SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
- SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
- MD5 47ad9cc420da0514ba1b00c8644623c3
- SHA1 ae21313963068b048e67ea7211e2e3b62269795b
- SHA512 9aedb22199721ad446e49421651fbdb3e1799bac3d3fae2e8f09644b650ad99fa60b1055e7f5b210d51e587ee1f71ee50c95ba81700a59efeec033da62e9627f
- TLSH T16F216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6538.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dlasmcqm.v1a.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Google.exe
- Size 11.8MB
- SHA256 cbf8ce620df61e3fe8399fbf7c50a321e84c84b0f9db60c915db4be252d35be3
- MD5 0256b8c3441b825cc24eb09aaf042b02
- SHA1 cee9d2ba2c4e235831babd2120874071814ddc3d
- SHA512 bcf69a4db3edb49c29cfc7530cb341c7bf0b512b07674874cba7c97356bfd589e3559189efec3536c73b3cadf7fb02d1d7bbb87d49571ce6caa47b517ac26d6e
- SSDEEP 196608:XBUF+eb6FLXBpbbSnW0uXhq0ww0dqcoFKMOC7mipZ5i+z8vHJiaVb/8dtU1Msoty:XBUF+eOFLXBpbbSnW0uXhVwNdqcn5C7w
- TLSH T17AC69D12B5608074F4A73231B43C67B949327EA29B3585CFB65C7C845FB86E2613A39F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIC201.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\QKARDrv.sys
- Size 45KB
- SHA256 54fcf1be0796ed6ad9aa55d29c72bfdb0839be0f48616a0e28a4ff886c713ee2
- MD5 b2d404cb5fb927a545cb5585374e251e
- SHA1 30b48958b8914eeba64604cefdd37df6fb8884a8
- SHA512 929f148434eb905c8f3a9fd9f0bd9fe7c349f4f988b742900d64b77abf23eef58ba4e3a917440e97e9b0e7ae9c98159298381e984876c67bf6a2319a1f66891e
- SSDEEP 768:9mO1UmYwiqeBDYyRcGaKMp4Rml1A97a5A9BZ5qUoNpdVTQOLk5kQ:gO1BYwiqedY+cGaKMp4RGA9PkdPQ
- TLSH T1E9235B43708417B8E622887581D2D84AF0B134D6177389CF8699F522BAD7BE4EF36D87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 d76edf26b939b41642a0a61e894de5d14fcdd9282baee4a21e1369719a20f57d
- MD5 ef3e3d1a6618c2e21611349dbaefa226
- SHA1 838f993a795265cd4b750fadff2ef3872f69d700
- SHA512 e6f3c72909c0ca3bc9d5f6fff1f205b1c969d31e4052379eaba95904888c8977b6e13e3cff79ff0e9ad2fb071752edc391fb8db8d5a005d1d3f3a4a7d4c7e76d
- SSDEEP 24576:kFo3DMP6doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+n:DHk
- TLSH T1BE57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f7b67dc6-3f94-4e09-8d8d-6316bffbc846}_OnDiskSnapshotProp
- Size 6KB
- SHA256 be577298be950538017201a8d3ce7bab04b040d69922920407c9f8ff6abae4b4
- MD5 f03fc932c16e6b0eda25143d6683bd64
- SHA1 a62f7808c30106f6f4a6d367745ca119bed48e3a
- SHA512 e0bd7b77942e64552a9bcb441489b91557db1ce88af6c1eb00e440d5e109122b9f9e00a33a04699dc44904af68d94b1d0c9ed4f4891d67a2b19d6b90f8070c35
- SSDEEP 96:FJIdCbjvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:rIEb++uVmN
- TLSH T1E6D188085AF54711E2B3AB7228F14557A837B912EF33CB8E0198238E6671910F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH