Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Google\Chrome\updater.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Windows\System32\drivers\etc\hosts
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2onzafnc.qa5.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ppgzy3k.pvg.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhg4u2sd.edt.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mohdy1o3.mhh.psm1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData)
-ExclusionExtension '.exe' -Force
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop UsoSvc
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop WaaSMedicSvc
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop wuauserv
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop bits
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop dosvc
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
|
|
|
|
C:\Windows\System32\powercfg.exe
|
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe stop eventlog
|
|
|
|
C:\Windows\System32\sc.exe
|
C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
|
|
|
|
C:\ProgramData\Google\Chrome\updater.exe
|
C:\ProgramData\Google\Chrome\updater.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wbem\WmiPrvSE.exe
|
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
|
||
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wusa.exe
|
wusa /uninstall /kb:890830 /quiet /norestart
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\svchost.exe
|
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
|
There are 25 hidden processes, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT
|
DontOfferThroughWUAU
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
44F8EFF000
|
stack
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
18F2FCA0000
|
heap
|
page read and write
|
||
|
15A9BFC0000
|
heap
|
page read and write
|
||
|
7FF61F1D1000
|
unkown
|
page readonly
|
||
|
7FF61F74E000
|
unkown
|
page execute read
|
||
|
276B74AC000
|
heap
|
page read and write
|
||
|
1FE93BA0000
|
heap
|
page read and write
|
||
|
1CAA81C9000
|
heap
|
page read and write
|
||
|
BDA4DAF000
|
stack
|
page read and write
|
||
|
6CC6AFF000
|
stack
|
page read and write
|
||
|
25EE3815000
|
heap
|
page read and write
|
||
|
1A3FE7E000
|
stack
|
page read and write
|
||
|
1CAA80E0000
|
heap
|
page read and write
|
||
|
1EEEBBA8000
|
heap
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
1EE43E3B000
|
heap
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
2B5D15F0000
|
heap
|
page read and write
|
||
|
7FF722D25000
|
unkown
|
page readonly
|
||
|
18FB3DC0000
|
heap
|
page read and write
|
||
|
1AB51340000
|
unkown
|
page read and write
|
||
|
66807FF000
|
stack
|
page read and write
|
||
|
2B5D16A0000
|
heap
|
page read and write
|
||
|
1EE43DE0000
|
trusted library allocation
|
page read and write
|
||
|
7FF721DA1000
|
unkown
|
page execute read
|
||
|
18F2FD18000
|
heap
|
page read and write
|
||
|
26BE2680000
|
heap
|
page read and write
|
||
|
7FF722485000
|
unkown
|
page readonly
|
||
|
981607F000
|
stack
|
page read and write
|
||
|
53E80FF000
|
stack
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
15A9C158000
|
heap
|
page read and write
|
||
|
1CAA8445000
|
heap
|
page read and write
|
||
|
1AB5373D000
|
unkown
|
page read and write
|
||
|
74C512C000
|
stack
|
page read and write
|
||
|
74C547E000
|
stack
|
page read and write
|
||
|
18FB3B50000
|
heap
|
page read and write
|
||
|
1EEEBDF5000
|
heap
|
page read and write
|
||
|
2B5D16A8000
|
heap
|
page read and write
|
||
|
15A9C0C0000
|
heap
|
page read and write
|
||
|
7FF722483000
|
unkown
|
page read and write
|
||
|
7FF72274A000
|
unkown
|
page execute and read and write
|
||
|
26BE2870000
|
heap
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
13CEFE75000
|
heap
|
page read and write
|
||
|
1EEEBDF0000
|
heap
|
page read and write
|
||
|
7FF721DA0000
|
unkown
|
page readonly
|
||
|
7FF61F1CE000
|
unkown
|
page readonly
|
||
|
7FF61F49D000
|
unkown
|
page execute and read and write
|
||
|
7FF61EAF1000
|
unkown
|
page execute read
|
||
|
7FF61F1D5000
|
unkown
|
page readonly
|
||
|
15A9C330000
|
heap
|
page read and write
|
||
|
25EE38B0000
|
heap
|
page read and write
|
||
|
7FF61EAF1000
|
unkown
|
page execute read
|
||
|
26BE2770000
|
heap
|
page read and write
|
||
|
1FE93AC0000
|
heap
|
page read and write
|
||
|
18FB3DC5000
|
heap
|
page read and write
|
||
|
BDA4D2F000
|
stack
|
page read and write
|
||
|
7FF721DA0000
|
unkown
|
page readonly
|
||
|
1AB510E0000
|
heap
|
page read and write
|
||
|
53E7EED000
|
stack
|
page read and write
|
||
|
13CEFAF0000
|
heap
|
page read and write
|
||
|
2B5D1610000
|
heap
|
page read and write
|
||
|
44F8F7F000
|
stack
|
page read and write
|
||
|
1CAA82E0000
|
heap
|
page read and write
|
||
|
18FB3AB0000
|
heap
|
page read and write
|
||
|
7FF721DB2000
|
unkown
|
page readonly
|
||
|
1AB51405000
|
heap
|
page read and write
|
||
|
25EE37E0000
|
heap
|
page read and write
|
||
|
262189E5000
|
heap
|
page read and write
|
||
|
7FF61EAF0000
|
unkown
|
page readonly
|
||
|
7FF61FA75000
|
unkown
|
page readonly
|
||
|
22CDE540000
|
heap
|
page read and write
|
||
|
7FF61F49A000
|
unkown
|
page execute and read and write
|
||
|
13CEFE70000
|
heap
|
page read and write
|
||
|
79BC4FE000
|
stack
|
page read and write
|
||
|
79BC5FF000
|
stack
|
page read and write
|
||
|
7FF61F1D3000
|
unkown
|
page read and write
|
||
|
15A9C335000
|
heap
|
page read and write
|
||
|
21B20E55000
|
heap
|
page read and write
|
||
|
7FF7229FE000
|
unkown
|
page execute read
|
||
|
7DB03FF000
|
stack
|
page read and write
|
||
|
7FF722485000
|
unkown
|
page readonly
|
||
|
262189E0000
|
heap
|
page read and write
|
||
|
BDA4CAD000
|
stack
|
page read and write
|
||
|
1EE43F02000
|
heap
|
page read and write
|
||
|
13CEFA90000
|
heap
|
page read and write
|
||
|
7DB00FD000
|
stack
|
page read and write
|
||
|
233DE550000
|
heap
|
page read and write
|
||
|
1EE43DB0000
|
heap
|
page read and write
|
||
|
21B20E50000
|
heap
|
page read and write
|
||
|
9815F7F000
|
stack
|
page read and write
|
||
|
53E7FFF000
|
stack
|
page read and write
|
||
|
22CDE150000
|
heap
|
page read and write
|
||
|
1EEEBD90000
|
heap
|
page read and write
|
||
|
51309FF000
|
stack
|
page read and write
|
||
|
53E7EFE000
|
stack
|
page read and write
|
||
|
233DE558000
|
heap
|
page read and write
|
||
|
18F2FD10000
|
heap
|
page read and write
|
||
|
22CDE1B8000
|
heap
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
8DD6DCC000
|
stack
|
page read and write
|
||
|
1EEEBD70000
|
heap
|
page read and write
|
||
|
7FF721DB5000
|
unkown
|
page read and write
|
||
|
1CAA8440000
|
heap
|
page read and write
|
||
|
26BE2890000
|
heap
|
page read and write
|
||
|
15A9C150000
|
heap
|
page read and write
|
||
|
18FB3AD0000
|
heap
|
page read and write
|
||
|
7FF722782000
|
unkown
|
page execute and read and write
|
||
|
CDBC13F000
|
stack
|
page read and write
|
||
|
13CEFA70000
|
heap
|
page read and write
|
||
|
7FF61F1D3000
|
unkown
|
page write copy
|
||
|
26BE28C0000
|
heap
|
page read and write
|
||
|
944FEFE000
|
stack
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
22CDE140000
|
heap
|
page read and write
|
||
|
51305DD000
|
stack
|
page read and write
|
||
|
1FE93E30000
|
heap
|
page read and write
|
||
|
276B74A0000
|
heap
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
22CDE545000
|
heap
|
page read and write
|
||
|
7FF61F1D1000
|
unkown
|
page readonly
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
B25807F000
|
stack
|
page read and write
|
||
|
1EE43E00000
|
heap
|
page read and write
|
||
|
7FF61F558000
|
unkown
|
page execute and read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
1EEEBB80000
|
heap
|
page read and write
|
||
|
B257F7F000
|
stack
|
page read and write
|
||
|
7FF7227B8000
|
unkown
|
page execute and read and write
|
||
|
7FF61F1D6000
|
unkown
|
page execute and read and write
|
||
|
1AB51239000
|
heap
|
page read and write
|
||
|
18F2FC80000
|
heap
|
page read and write
|
||
|
1AB52EF0000
|
direct allocation
|
page read and write
|
||
|
8DD70FF000
|
stack
|
page read and write
|
||
|
21B20A70000
|
heap
|
page read and write
|
||
|
233DE500000
|
heap
|
page read and write
|
||
|
7FF61F508000
|
unkown
|
page execute and read and write
|
||
|
7FF7229FE000
|
unkown
|
page execute read
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
1EE43E13000
|
heap
|
page read and write
|
||
|
CDBC0BD000
|
stack
|
page read and write
|
||
|
2B5D19A0000
|
heap
|
page read and write
|
||
|
1AB51230000
|
heap
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
18FB3B58000
|
heap
|
page read and write
|
||
|
1CAA81C0000
|
heap
|
page read and write
|
||
|
22CDE170000
|
heap
|
page read and write
|
||
|
1EE43DA0000
|
heap
|
page read and write
|
||
|
7FF721DA1000
|
unkown
|
page execute read
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
7FF722481000
|
unkown
|
page readonly
|
||
|
1AB511E0000
|
heap
|
page read and write
|
||
|
7FF61F74E000
|
unkown
|
page execute read
|
||
|
8DD71FF000
|
stack
|
page read and write
|
||
|
276B7400000
|
heap
|
page read and write
|
||
|
2B5D15E0000
|
heap
|
page read and write
|
||
|
76C25BD000
|
stack
|
page read and write
|
||
|
233DE510000
|
heap
|
page read and write
|
||
|
7FF72247E000
|
unkown
|
page readonly
|
||
|
262185B0000
|
heap
|
page read and write
|
||
|
94504FE000
|
stack
|
page read and write
|
||
|
44F8E7D000
|
stack
|
page read and write
|
||
|
53E81FF000
|
stack
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
276B74BE000
|
heap
|
page read and write
|
||
|
66806FF000
|
stack
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
9815E7D000
|
stack
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
13CEFA60000
|
heap
|
page read and write
|
||
|
1A3FD7E000
|
stack
|
page read and write
|
||
|
21B20AD0000
|
heap
|
page read and write
|
||
|
276B73E0000
|
heap
|
page read and write
|
||
|
233DE8A0000
|
heap
|
page read and write
|
||
|
7FF61EB02000
|
unkown
|
page readonly
|
||
|
1AB51330000
|
unkown
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
1EE44602000
|
trusted library allocation
|
page read and write
|
||
|
18F30045000
|
heap
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
74C51AE000
|
stack
|
page read and write
|
||
|
7FF61F552000
|
unkown
|
page execute and read and write
|
||
|
276B7D40000
|
direct allocation
|
page read and write
|
||
|
1FE93BC0000
|
heap
|
page read and write
|
||
|
18F30040000
|
heap
|
page read and write
|
||
|
7FF722808000
|
unkown
|
page execute and read and write
|
||
|
1AB511C0000
|
heap
|
page read and write
|
||
|
7FF61EB05000
|
unkown
|
page write copy
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
2B5D19A5000
|
heap
|
page read and write
|
||
|
127087F000
|
stack
|
page read and write
|
||
|
7FF721DB5000
|
unkown
|
page write copy
|
||
|
26218788000
|
heap
|
page read and write
|
||
|
7FF722D25000
|
unkown
|
page readonly
|
||
|
21B20A60000
|
heap
|
page read and write
|
||
|
7FF722486000
|
unkown
|
page execute and read and write
|
||
|
1AB52EF0000
|
unkown
|
page read and write
|
||
|
22CDE1B0000
|
heap
|
page read and write
|
||
|
944FFFE000
|
unkown
|
page readonly
|
||
|
7FF61FA75000
|
unkown
|
page readonly
|
||
|
1AB51400000
|
heap
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
944FDFE000
|
unkown
|
page readonly
|
||
|
21B20A90000
|
heap
|
page read and write
|
||
|
944F73B000
|
stack
|
page read and write
|
||
|
7FF722802000
|
unkown
|
page execute and read and write
|
||
|
66803BD000
|
stack
|
page read and write
|
||
|
944FCFD000
|
stack
|
page read and write
|
||
|
276B72E0000
|
heap
|
page read and write
|
||
|
25EE37F0000
|
heap
|
page read and write
|
||
|
76C287F000
|
stack
|
page read and write
|
||
|
1EE43D80000
|
heap
|
page read and write
|
||
|
7DB01FF000
|
stack
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
7DB02FF000
|
stack
|
page read and write
|
||
|
127054D000
|
stack
|
page read and write
|
||
|
1EE43E02000
|
heap
|
page read and write
|
||
|
25EE38B8000
|
heap
|
page read and write
|
||
|
7FF721DB2000
|
unkown
|
page readonly
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
6CC66CD000
|
stack
|
page read and write
|
||
|
7FF722483000
|
unkown
|
page write copy
|
||
|
7FF61EAF0000
|
unkown
|
page readonly
|
||
|
1CAA82C0000
|
heap
|
page read and write
|
||
|
25EE3810000
|
heap
|
page read and write
|
||
|
7FF72247E000
|
unkown
|
page readonly
|
||
|
18F2FC70000
|
heap
|
page read and write
|
||
|
1A3FC7D000
|
stack
|
page read and write
|
||
|
1FE93E35000
|
heap
|
page read and write
|
||
|
13CEFAF8000
|
heap
|
page read and write
|
||
|
79BC18D000
|
stack
|
page read and write
|
||
|
127097F000
|
stack
|
page read and write
|
||
|
22CDFC80000
|
heap
|
page read and write
|
||
|
7FF61F1CE000
|
unkown
|
page readonly
|
||
|
B257E7C000
|
stack
|
page read and write
|
||
|
1EE43E2B000
|
heap
|
page read and write
|
||
|
26218780000
|
heap
|
page read and write
|
||
|
7FF72274D000
|
unkown
|
page execute and read and write
|
||
|
6CC67CE000
|
stack
|
page read and write
|
||
|
276B7420000
|
direct allocation
|
page read and write
|
||
|
51308FE000
|
stack
|
page read and write
|
||
|
25EE3820000
|
heap
|
page read and write
|
||
|
233DE530000
|
heap
|
page read and write
|
||
|
26218690000
|
heap
|
page read and write
|
||
|
7FF61F4D2000
|
unkown
|
page execute and read and write
|
||
|
1EEEBBA0000
|
heap
|
page read and write
|
||
|
94505FE000
|
unkown
|
page readonly
|
||
|
21B20AD8000
|
heap
|
page read and write
|
||
|
7FF61F1D5000
|
unkown
|
page readonly
|
||
|
1AB5123C000
|
heap
|
page read and write
|
||
|
1AB51210000
|
direct allocation
|
page read and write
|
||
|
233DE8A5000
|
heap
|
page read and write
|
||
|
7FF61EB05000
|
unkown
|
page read and write
|
||
|
26BE28C5000
|
heap
|
page read and write
|
||
|
18FB39D0000
|
heap
|
page read and write
|
||
|
276B7405000
|
heap
|
page read and write
|
||
|
76C28FF000
|
stack
|
page read and write
|
||
|
262186B0000
|
heap
|
page read and write
|
||
|
276B73C0000
|
heap
|
page read and write
|
||
|
26BE2778000
|
heap
|
page read and write
|
||
|
1FE93C00000
|
heap
|
page read and write
|
||
|
1EE43E43000
|
heap
|
page read and write
|
||
|
7FF61EB02000
|
unkown
|
page readonly
|
||
|
15A9C0A0000
|
heap
|
page read and write
|
||
|
7FF722481000
|
unkown
|
page readonly
|
||
|
1FE93C08000
|
heap
|
page read and write
|
There are 259 hidden memdumps, click here to show them.