Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
prog.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\win32\svhost.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\prog.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c14qiz0m.w44.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2k44ady.woi.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pya4eufh.ber.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqt1u0o5.fl2.psm1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\prog.exe
|
"C:\Users\user\Desktop\prog.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\prog.exe
|
"C:\Users\user\AppData\Local\Temp\prog.exe"
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData)
-ExclusionExtension '.exe' -Force
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop UsoSvc
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop WaaSMedicSvc
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop wuauserv
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop bits
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop dosvc
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe delete "appdata"
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop eventlog
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe start "appdata"
|
|
|
|
C:\ProgramData\win32\svhost.exe
|
C:\ProgramData\win32\svhost.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wbem\WmiPrvSE.exe
|
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
|
||
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wusa.exe
|
wusa /uninstall /kb:890830 /quiet /norestart
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 25 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://discord.com/2
|
unknown
|
||
|
https://discord.com/6
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT
|
DontOfferThroughWUAU
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
400000
|
unkown
|
page readonly
|
||
|
21C73860000
|
heap
|
page read and write
|
||
|
CCEE96F000
|
stack
|
page read and write
|
||
|
205352E9000
|
heap
|
page read and write
|
||
|
205352E0000
|
heap
|
page read and write
|
||
|
2AFE0A60000
|
heap
|
page read and write
|
||
|
1483F548000
|
heap
|
page read and write
|
||
|
1F30F940000
|
heap
|
page read and write
|
||
|
14722A90000
|
heap
|
page read and write
|
||
|
B70737F000
|
stack
|
page read and write
|
||
|
86D000
|
heap
|
page read and write
|
||
|
1F1D9600000
|
heap
|
page read and write
|
||
|
21C739D0000
|
heap
|
page read and write
|
||
|
48CF000
|
stack
|
page read and write
|
||
|
BCA8BCE000
|
stack
|
page read and write
|
||
|
278F6C70000
|
heap
|
page read and write
|
||
|
1483F460000
|
heap
|
page read and write
|
||
|
844000
|
heap
|
page read and write
|
||
|
245F000
|
stack
|
page read and write
|
||
|
7FF66486B000
|
unkown
|
page readonly
|
||
|
7FF7B7AF1000
|
unkown
|
page execute read
|
||
|
20535520000
|
unkown
|
page read and write
|
||
|
278F7035000
|
heap
|
page read and write
|
||
|
25A84E20000
|
heap
|
page read and write
|
||
|
21795890000
|
heap
|
page read and write
|
||
|
7FF7B7AFB000
|
unkown
|
page readonly
|
||
|
26BC0F60000
|
heap
|
page read and write
|
||
|
1C0000
|
heap
|
page read and write
|
||
|
142A1140000
|
heap
|
page read and write
|
||
|
3F00000
|
heap
|
page read and write
|
||
|
1F1D9500000
|
heap
|
page read and write
|
||
|
402000
|
unkown
|
page readonly
|
||
|
21C73670000
|
heap
|
page read and write
|
||
|
26BC1020000
|
heap
|
page read and write
|
||
|
DADC5FF000
|
stack
|
page read and write
|
||
|
205352E6000
|
heap
|
page read and write
|
||
|
2BBE4800000
|
heap
|
page read and write
|
||
|
A74000
|
heap
|
page read and write
|
||
|
1F4CBE10000
|
heap
|
page read and write
|
||
|
7FF66486F000
|
unkown
|
page write copy
|
||
|
14722A50000
|
heap
|
page read and write
|
||
|
82D000
|
heap
|
page read and write
|
||
|
142A14F0000
|
heap
|
page read and write
|
||
|
2A1C2DC5000
|
heap
|
page read and write
|
||
|
19C01580000
|
heap
|
page read and write
|
||
|
155937E000
|
stack
|
page read and write
|
||
|
2A1C2A80000
|
heap
|
page read and write
|
||
|
2AFE0980000
|
heap
|
page read and write
|
||
|
DADC19D000
|
stack
|
page read and write
|
||
|
4B0C000
|
stack
|
page read and write
|
||
|
7FF664860000
|
unkown
|
page readonly
|
||
|
266072E000
|
stack
|
page read and write
|
||
|
7FF7B7AFE000
|
unkown
|
page write copy
|
||
|
278F7030000
|
heap
|
page read and write
|
||
|
49AE77E000
|
unkown
|
page readonly
|
||
|
2BBE48E0000
|
heap
|
page read and write
|
||
|
C95A97F000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
25A84C30000
|
heap
|
page read and write
|
||
|
1C5000
|
heap
|
page read and write
|
||
|
14722770000
|
heap
|
page read and write
|
||
|
A85000
|
heap
|
page read and write
|
||
|
205354C0000
|
heap
|
page read and write
|
||
|
1F30FCC5000
|
heap
|
page read and write
|
||
|
19C01600000
|
heap
|
page read and write
|
||
|
C55096D000
|
stack
|
page read and write
|
||
|
278F6C78000
|
heap
|
page read and write
|
||
|
20535515000
|
heap
|
page read and write
|
||
|
14722778000
|
heap
|
page read and write
|
||
|
49AE7FF000
|
stack
|
page read and write
|
||
|
7FF664861000
|
unkown
|
page execute read
|
||
|
402000
|
unkown
|
page readonly
|
||
|
21795870000
|
heap
|
page read and write
|
||
|
403000
|
unkown
|
page read and write
|
||
|
205352EB000
|
heap
|
page read and write
|
||
|
2C3E000
|
stack
|
page read and write
|
||
|
71E22FF000
|
stack
|
page read and write
|
||
|
A4F000
|
stack
|
page read and write
|
||
|
91F9EFE000
|
stack
|
page read and write
|
||
|
205353E0000
|
heap
|
page read and write
|
||
|
155927F000
|
stack
|
page read and write
|
||
|
26BC0F80000
|
heap
|
page read and write
|
||
|
71E227D000
|
stack
|
page read and write
|
||
|
217959C5000
|
heap
|
page read and write
|
||
|
27A0000
|
heap
|
page read and write
|
||
|
19C01980000
|
heap
|
page read and write
|
||
|
6DA000
|
unkown
|
page read and write
|
||
|
DADC4FF000
|
stack
|
page read and write
|
||
|
411000
|
unkown
|
page write copy
|
||
|
1F1D9400000
|
heap
|
page read and write
|
||
|
8AD000
|
heap
|
page read and write
|
||
|
142A14F5000
|
heap
|
page read and write
|
||
|
278F6BB0000
|
heap
|
page read and write
|
||
|
49AE3AC000
|
stack
|
page read and write
|
||
|
810000
|
heap
|
page read and write
|
||
|
C95A87D000
|
stack
|
page read and write
|
||
|
CCEE8ED000
|
stack
|
page read and write
|
||
|
ED2208D000
|
stack
|
page read and write
|
||
|
278F6BA0000
|
heap
|
page read and write
|
||
|
1F1D9620000
|
heap
|
page read and write
|
||
|
2A1C2B80000
|
heap
|
page read and write
|
||
|
98000
|
stack
|
page read and write
|
||
|
BCA8EFF000
|
stack
|
page read and write
|
||
|
2A1C2DC0000
|
heap
|
page read and write
|
||
|
19C01590000
|
heap
|
page read and write
|
||
|
2AFE0B60000
|
heap
|
page read and write
|
||
|
6E0000
|
heap
|
page read and write
|
||
|
1F4CBD55000
|
heap
|
page read and write
|
||
|
403000
|
unkown
|
page write copy
|
||
|
1F4CBC60000
|
heap
|
page read and write
|
||
|
1F1D95E0000
|
heap
|
page read and write
|
||
|
A8A000
|
heap
|
page read and write
|
||
|
C73F9D000
|
stack
|
page read and write
|
||
|
147226D0000
|
heap
|
page read and write
|
||
|
7FF7B7D80000
|
unkown
|
page readonly
|
||
|
7FF7B7AFB000
|
unkown
|
page readonly
|
||
|
19A000
|
stack
|
page read and write
|
||
|
20535510000
|
heap
|
page read and write
|
||
|
1F4CBD80000
|
heap
|
page read and write
|
||
|
851000
|
heap
|
page read and write
|
||
|
7FF7B7D7B000
|
unkown
|
page read and write
|
||
|
297E000
|
stack
|
page read and write
|
||
|
26BC1028000
|
heap
|
page read and write
|
||
|
854000
|
heap
|
page read and write
|
||
|
1F1D9414000
|
heap
|
page read and write
|
||
|
850000
|
heap
|
page read and write
|
||
|
C550C7E000
|
stack
|
page read and write
|
||
|
7FF7B7AFF000
|
unkown
|
page write copy
|
||
|
21C73690000
|
heap
|
page read and write
|
||
|
2A1C2B60000
|
heap
|
page read and write
|
||
|
8AD000
|
heap
|
page read and write
|
||
|
2BBE4988000
|
heap
|
page read and write
|
||
|
49AE87E000
|
unkown
|
page readonly
|
||
|
21C73880000
|
heap
|
page read and write
|
||
|
14722A95000
|
heap
|
page read and write
|
||
|
21795779000
|
heap
|
page read and write
|
||
|
142A1110000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
F57019D000
|
stack
|
page read and write
|
||
|
2BBE4910000
|
heap
|
page read and write
|
||
|
2A1C2BB0000
|
heap
|
page read and write
|
||
|
2BFE000
|
stack
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
2AFE0BC0000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
7FF7B7AF1000
|
unkown
|
page execute read
|
||
|
C95AA7E000
|
stack
|
page read and write
|
||
|
86C000
|
heap
|
page read and write
|
||
|
1F4CBE18000
|
heap
|
page read and write
|
||
|
21C739D5000
|
heap
|
page read and write
|
||
|
235E000
|
stack
|
page read and write
|
||
|
2AFE0BC5000
|
heap
|
page read and write
|
||
|
7FF664AEB000
|
unkown
|
page read and write
|
||
|
91F9BCD000
|
stack
|
page read and write
|
||
|
49CF000
|
stack
|
page read and write
|
||
|
26607AE000
|
stack
|
page read and write
|
||
|
ED2218E000
|
stack
|
page read and write
|
||
|
BCA8ACD000
|
stack
|
page read and write
|
||
|
1558F7C000
|
stack
|
page read and write
|
||
|
7FF66486E000
|
unkown
|
page read and write
|
||
|
19C01985000
|
heap
|
page read and write
|
||
|
26606AC000
|
stack
|
page read and write
|
||
|
7FF7B7D7D000
|
unkown
|
page readonly
|
||
|
2ABE000
|
stack
|
page read and write
|
||
|
25A84F85000
|
heap
|
page read and write
|
||
|
156047D000
|
stack
|
page read and write
|
||
|
26BC0F50000
|
heap
|
page read and write
|
||
|
91F9BDD000
|
stack
|
page read and write
|
||
|
2AFE0A68000
|
heap
|
page read and write
|
||
|
1F1D9408000
|
heap
|
page read and write
|
||
|
25A84C38000
|
heap
|
page read and write
|
||
|
7FF7B7D7D000
|
unkown
|
page readonly
|
||
|
7CE02FC000
|
stack
|
page read and write
|
||
|
1F4CBD60000
|
heap
|
page read and write
|
||
|
86C000
|
heap
|
page read and write
|
||
|
7FF66486E000
|
unkown
|
page write copy
|
||
|
47D9000
|
heap
|
page read and write
|
||
|
7FF7B7AF0000
|
unkown
|
page readonly
|
||
|
7FF664AF0000
|
unkown
|
page readonly
|
||
|
2A7F000
|
stack
|
page read and write
|
||
|
8B1000
|
heap
|
page read and write
|
||
|
25A84F80000
|
heap
|
page read and write
|
||
|
147226F0000
|
heap
|
page read and write
|
||
|
142A1120000
|
heap
|
page read and write
|
||
|
1483F380000
|
heap
|
page read and write
|
||
|
7FF7B7AF0000
|
unkown
|
page readonly
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
3F10000
|
heap
|
page read and write
|
||
|
851000
|
heap
|
page read and write
|
||
|
21795680000
|
heap
|
page read and write
|
||
|
2BBE4980000
|
heap
|
page read and write
|
||
|
2C7E000
|
stack
|
page read and write
|
||
|
2BBF000
|
stack
|
page read and write
|
||
|
C550D7E000
|
stack
|
page read and write
|
||
|
1483F540000
|
heap
|
page read and write
|
||
|
F5704FF000
|
stack
|
page read and write
|
||
|
1F1D9625000
|
heap
|
page read and write
|
||
|
F57047F000
|
stack
|
page read and write
|
||
|
1483F7F0000
|
heap
|
page read and write
|
||
|
26BC12B5000
|
heap
|
page read and write
|
||
|
142A11C8000
|
heap
|
page read and write
|
||
|
142A11C0000
|
heap
|
page read and write
|
||
|
1F30F8F0000
|
heap
|
page read and write
|
||
|
4ACF000
|
stack
|
page read and write
|
||
|
1483F480000
|
heap
|
page read and write
|
||
|
1F30F8C0000
|
heap
|
page read and write
|
||
|
B70727D000
|
stack
|
page read and write
|
||
|
4C0C000
|
stack
|
page read and write
|
||
|
7CE06FF000
|
stack
|
page read and write
|
||
|
2A1C2BB8000
|
heap
|
page read and write
|
||
|
217959C0000
|
heap
|
page read and write
|
||
|
7FF664861000
|
unkown
|
page execute read
|
||
|
1483F7F5000
|
heap
|
page read and write
|
||
|
848000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2AFE0B80000
|
heap
|
page read and write
|
||
|
7FF664AF0000
|
unkown
|
page readonly
|
||
|
1F30F8D0000
|
heap
|
page read and write
|
||
|
7FF664AED000
|
unkown
|
page readonly
|
||
|
848000
|
heap
|
page read and write
|
||
|
850000
|
heap
|
page read and write
|
||
|
7FF664860000
|
unkown
|
page readonly
|
||
|
7CE03FF000
|
stack
|
page read and write
|
||
|
2BBE48F0000
|
heap
|
page read and write
|
||
|
3FD0000
|
trusted library allocation
|
page read and write
|
||
|
1F30F947000
|
heap
|
page read and write
|
||
|
A80000
|
heap
|
page read and write
|
||
|
7FF664AED000
|
unkown
|
page readonly
|
||
|
205354E0000
|
heap
|
page read and write
|
||
|
7FF66486B000
|
unkown
|
page readonly
|
||
|
7FF7B7AFE000
|
unkown
|
page read and write
|
||
|
408000
|
unkown
|
page read and write
|
||
|
21795770000
|
heap
|
page read and write
|
||
|
B7072FF000
|
stack
|
page read and write
|
||
|
1F30FCC0000
|
heap
|
page read and write
|
||
|
2BBE48E5000
|
heap
|
page read and write
|
||
|
278F6BD0000
|
heap
|
page read and write
|
||
|
94E000
|
stack
|
page read and write
|
||
|
7FF7B7D80000
|
unkown
|
page readonly
|
||
|
1F4CBD50000
|
heap
|
page read and write
|
||
|
49AE6FE000
|
stack
|
page read and write
|
||
|
ED224FF000
|
stack
|
page read and write
|
||
|
25A84D40000
|
heap
|
page read and write
|
||
|
81B000
|
heap
|
page read and write
|
||
|
26BC12B0000
|
heap
|
page read and write
|
||
|
147226C0000
|
heap
|
page read and write
|
||
|
1F30F94A000
|
heap
|
page read and write
|
||
|
21C73698000
|
heap
|
page read and write
|
||
|
411000
|
unkown
|
page write copy
|
||
|
25A84E40000
|
heap
|
page read and write
|
There are 240 hidden memdumps, click here to show them.