Malware Analysis Report

2024-11-16 10:45

Sample ID 240603-ld6y7saa7s
Target 3974c5d0b92366bbc9af950c8d7f898d.exe
SHA256 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820
Tags
evasion execution persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820

Threat Level: Known bad

The file 3974c5d0b92366bbc9af950c8d7f898d.exe was found to be: Known bad.

Malicious Activity Summary

evasion execution persistence

Modifies security service

Drops file in Drivers directory

Stops running service(s)

Sets service image path in registry

Command and Scripting Interpreter: PowerShell

Creates new service(s)

Loads dropped DLL

Executes dropped EXE

Checks BIOS information in registry

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 09:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 09:26

Reported

2024-06-03 09:28

Platform

win7-20240221-en

Max time kernel

150s

Max time network

147s

Command Line

winlogon.exe

Signatures

Modifies security service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP C:\Windows\System32\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection C:\Windows\System32\svchost.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
File created C:\Windows\system32\drivers\etc\hosts C:\ProgramData\Google\Chrome\updater.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\GoogleUpdateTaskMachineQC\ImagePath = "C:\\ProgramData\\Google\\Chrome\\updater.exe" C:\Windows\system32\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0\ImagePath = "\\??\\C:\\Windows\\TEMP\\qvezzpzmjlus.sys" C:\Windows\system32\services.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Google\Chrome\updater.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\system32\services.exe N/A
N/A N/A C:\Windows\system32\services.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\perfh007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\Google\Chrome\updater.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\PerfStringBackup.TMP C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
File created C:\Windows\system32\perfc00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\PerfStringBackup.INI C:\Windows\system32\wbem\WMIADAP.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2072 set thread context of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 752 set thread context of 2972 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe
PID 752 set thread context of 2736 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe
PID 752 set thread context of 2328 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A
File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf C:\Windows\system32\svchost.exe N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = a0c83f1e98b5da01 C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\ProgramData\Google\Chrome\updater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\system32\services.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2500 wrote to memory of 424 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\winlogon.exe
PID 2500 wrote to memory of 468 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\services.exe
PID 2500 wrote to memory of 484 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsass.exe
PID 2500 wrote to memory of 492 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsm.exe
PID 2500 wrote to memory of 604 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 680 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 756 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 2500 wrote to memory of 820 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 2500 wrote to memory of 860 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 1000 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 304 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 460 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 2500 wrote to memory of 1052 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 1204 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\taskhost.exe
PID 2500 wrote to memory of 1300 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\Dwm.exe
PID 2500 wrote to memory of 1352 N/A C:\Windows\system32\dialer.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 2860 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 2500 wrote to memory of 3044 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sppsvc.exe
PID 2500 wrote to memory of 2072 N/A C:\Windows\system32\dialer.exe C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe
PID 2500 wrote to memory of 2828 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\cmd.exe
PID 2500 wrote to memory of 2904 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\powercfg.exe
PID 2500 wrote to memory of 2460 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\powercfg.exe
PID 2500 wrote to memory of 2492 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\powercfg.exe
PID 2828 wrote to memory of 1444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2828 wrote to memory of 1444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2828 wrote to memory of 1444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2500 wrote to memory of 2480 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\powercfg.exe
PID 2500 wrote to memory of 2576 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 2580 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 2592 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 2612 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 2700 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 2552 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sc.exe
PID 2500 wrote to memory of 2512 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 1444 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\wusa.exe
PID 2500 wrote to memory of 1540 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sc.exe
PID 2500 wrote to memory of 2120 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 1960 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sc.exe
PID 2500 wrote to memory of 3024 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sc.exe
PID 2500 wrote to memory of 2256 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 2500 wrote to memory of 752 N/A C:\Windows\system32\dialer.exe C:\ProgramData\Google\Chrome\updater.exe
PID 468 wrote to memory of 752 N/A C:\Windows\system32\services.exe C:\ProgramData\Google\Chrome\updater.exe
PID 468 wrote to memory of 752 N/A C:\Windows\system32\services.exe C:\ProgramData\Google\Chrome\updater.exe
PID 468 wrote to memory of 752 N/A C:\Windows\system32\services.exe C:\ProgramData\Google\Chrome\updater.exe
PID 2500 wrote to memory of 752 N/A C:\Windows\system32\dialer.exe C:\ProgramData\Google\Chrome\updater.exe
PID 2500 wrote to memory of 1612 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2500 wrote to memory of 1952 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\conhost.exe
PID 860 wrote to memory of 844 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 860 wrote to memory of 844 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 860 wrote to memory of 844 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 2500 wrote to memory of 844 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 2500 wrote to memory of 844 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 2500 wrote to memory of 988 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\cmd.exe
PID 2500 wrote to memory of 1584 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\powercfg.exe
PID 752 wrote to memory of 2972 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe
PID 752 wrote to memory of 2972 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe
PID 752 wrote to memory of 2972 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe

"C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1116762120-2037301247130413622-2045395588-2586739531398719149987590751-191647949"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "5192165331999510635-195080311836903501151422500121045468681049619575-618321642"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "276670252-2069308083-138396887-85956715-1255445550167147642-2138315398-1092516482"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1740711782-870965568-22470489191597876-134059547118785522611512229066-821686139"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1178585006-56133724115089679081499155302589969009440371218-234057191548315423"

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1820964759-846273262-599896880194718598713435858281427952101198909985-179245363"

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1919533166883249922-8867372151242629272-1047405022-630032926-908434638-88989299"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1433276944-184935152216912598011424147541-54456828175703470-96669093897550865"

C:\ProgramData\Google\Chrome\updater.exe

C:\ProgramData\Google\Chrome\updater.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-885688409-7553941111590729337-1926380417527299899-2030081145-18358453881212431560"

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-9972073061324782060-1090892831-3362567711788016645-2041754389721691611739454577"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-104312574813149306911837919207422193843563939567-907382105-9293663041038675147"

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-112146812-890173971-154557236919907907957537360472625300321931523919-367499482"

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1540691399-401324203-2862765539616077791425523537-1232600564225396602-1556473352"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-812134478-1154955227-1797078520557892086-1114037894132565570013546432551022383062"

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\dialer.exe

dialer.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 randomxmonero.auto.nicehash.com udp
MD 45.67.229.122:80 45.67.229.122 tcp
US 34.149.22.228:443 randomxmonero.auto.nicehash.com tcp
MD 45.67.229.122:80 45.67.229.122 tcp
MD 45.67.229.122:80 45.67.229.122 tcp

Files

memory/2308-4-0x000007FEF4D5E000-0x000007FEF4D5F000-memory.dmp

memory/2308-5-0x000000001B240000-0x000000001B522000-memory.dmp

memory/2308-7-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

memory/2308-6-0x0000000001F10000-0x0000000001F18000-memory.dmp

memory/2308-8-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

memory/2308-10-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

memory/2308-9-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

memory/2308-11-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

memory/2308-12-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

memory/2500-16-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2576-151-0x0000000037540000-0x0000000037550000-memory.dmp

memory/2500-235-0x0000000077500000-0x00000000776A9000-memory.dmp

memory/2576-150-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/2576-149-0x00000000001F0000-0x000000000021B000-memory.dmp

memory/2480-147-0x0000000037540000-0x0000000037550000-memory.dmp

memory/2480-146-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/2480-145-0x0000000000290000-0x00000000002BB000-memory.dmp

memory/2828-143-0x0000000037540000-0x0000000037550000-memory.dmp

memory/2828-142-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/2828-141-0x0000000000210000-0x000000000023B000-memory.dmp

memory/1204-139-0x0000000037540000-0x0000000037550000-memory.dmp

memory/1204-138-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/2460-136-0x0000000037540000-0x0000000037550000-memory.dmp

memory/2460-135-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/2460-134-0x0000000001B70000-0x0000000001B9B000-memory.dmp

memory/1000-132-0x0000000037540000-0x0000000037550000-memory.dmp

memory/1000-131-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/2860-129-0x0000000037540000-0x0000000037550000-memory.dmp

memory/2860-128-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/2860-127-0x00000000001B0000-0x00000000001DB000-memory.dmp

memory/1204-126-0x0000000001C90000-0x0000000001CBB000-memory.dmp

memory/1052-124-0x0000000037540000-0x0000000037550000-memory.dmp

memory/1052-123-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/1052-122-0x0000000000850000-0x000000000087B000-memory.dmp

memory/460-120-0x0000000037540000-0x0000000037550000-memory.dmp

memory/460-119-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/460-118-0x0000000001C20000-0x0000000001C4B000-memory.dmp

memory/1000-117-0x00000000003C0000-0x00000000003EB000-memory.dmp

memory/820-115-0x0000000037540000-0x0000000037550000-memory.dmp

memory/820-114-0x000007FEBDD10000-0x000007FEBDD20000-memory.dmp

memory/820-113-0x0000000000820000-0x000000000084B000-memory.dmp

memory/2500-107-0x0000000077501000-0x0000000077602000-memory.dmp

memory/2460-102-0x0000000001B40000-0x0000000001B64000-memory.dmp

memory/2460-100-0x0000000001B40000-0x0000000001B64000-memory.dmp

memory/2500-22-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2500-17-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2500-21-0x00000000773E0000-0x00000000774FF000-memory.dmp

memory/2500-20-0x0000000077500000-0x00000000776A9000-memory.dmp

memory/2500-15-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2500-19-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2500-14-0x0000000140000000-0x000000014002B000-memory.dmp

\ProgramData\Google\Chrome\updater.exe

MD5 3974c5d0b92366bbc9af950c8d7f898d
SHA1 1b141b9cced64d1b86cd9d3460062ee7ecd34357
SHA256 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820
SHA512 6b786fcf6ad40c3f8007e55242db7794f640177f3394a49a3ac9dc3b6cf3588eefe8e3db8ed21d9fcc3962de50d48c6c28867ab92a7da324389e19b9642170fa

memory/1612-325-0x0000000019D10000-0x0000000019FF2000-memory.dmp

memory/1612-326-0x0000000000440000-0x0000000000448000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 3e9af076957c5b2f9c9ce5ec994bea05
SHA1 a8c7326f6bceffaeed1c2bb8d7165e56497965fe
SHA256 e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e
SHA512 933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

memory/2500-451-0x0000000077500000-0x00000000776A9000-memory.dmp

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 46d08e3a55f007c523ac64dce6dcf478
SHA1 62edf88697e98d43f32090a2197bead7e7244245
SHA256 5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512 b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

C:\Windows\System32\perfc011.dat

MD5 1f998386566e5f9b7f11cc79254d1820
SHA1 e1da5fe1f305099b94de565d06bc6f36c6794481
SHA256 1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512 a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

C:\Windows\System32\perfh009.dat

MD5 aecab86cc5c705d7a036cba758c1d7b0
SHA1 e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA256 9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512 e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8

C:\Windows\System32\perfh007.dat

MD5 b69ab3aeddb720d6ef8c05ff88c23b38
SHA1 d830c2155159656ed1806c7c66cae2a54a2441fa
SHA256 24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA512 4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d

C:\Windows\System32\perfc007.dat

MD5 19c7052de3b7281b4c1c6bfbb543c5dc
SHA1 d2e12081a14c1069c89f2cee7357a559c27786e7
SHA256 14ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512 289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83

C:\Windows\System32\perfh00A.dat

MD5 7d0bac4e796872daa3f6dc82c57f4ca8
SHA1 b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256 ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512 145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

C:\Windows\System32\perfc00A.dat

MD5 f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1 961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256 cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512 116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294

C:\Windows\System32\perfh011.dat

MD5 54c674d19c0ff72816402f66f6c3d37c
SHA1 2dcc0269545a213648d59dc84916d9ec2d62a138
SHA256 646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA512 4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

C:\Windows\System32\perfh010.dat

MD5 4623482c106cf6cc1bac198f31787b65
SHA1 5abb0decf7b42ef5daf7db012a742311932f6dad
SHA256 eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512 afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

C:\Windows\System32\perfc010.dat

MD5 d73172c6cb697755f87cd047c474cf91
SHA1 abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA256 9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA512 7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

C:\Windows\System32\perfh00C.dat

MD5 5f684ce126de17a7d4433ed2494c5ca9
SHA1 ce1a30a477daa1bac2ec358ce58731429eafe911
SHA256 2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA512 4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

C:\Windows\System32\perfc00C.dat

MD5 ce233fa5dc5adcb87a5185617a0ff6ac
SHA1 2e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA256 68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA512 1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 09:26

Reported

2024-06-03 09:28

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

149s

Command Line

winlogon.exe

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
File created C:\Windows\system32\drivers\etc\hosts C:\ProgramData\Google\Chrome\updater.exe N/A

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\system32\wbem\wmiprvse.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Google\Chrome\updater.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\Google\Chrome\updater.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Windows\system32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2476 set thread context of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 3384 set thread context of 4916 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe
PID 3384 set thread context of 5036 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe
PID 3384 set thread context of 4260 N/A C:\ProgramData\Google\Chrome\updater.exe C:\Windows\system32\dialer.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 03 Jun 2024 09:27:40 GMT" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717406859" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe N/A
N/A N/A C:\ProgramData\Google\Chrome\updater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2476 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2476 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2476 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2476 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2476 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2476 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2476 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe C:\Windows\system32\dialer.exe
PID 2564 wrote to memory of 2164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2564 wrote to memory of 2164 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 388 wrote to memory of 612 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\winlogon.exe
PID 388 wrote to memory of 664 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsass.exe
PID 388 wrote to memory of 960 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 380 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\dwm.exe
PID 388 wrote to memory of 432 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 404 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 956 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1072 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1156 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1164 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1204 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1212 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1296 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1324 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1396 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1412 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1536 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1556 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1672 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1688 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1724 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1792 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1800 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1896 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1904 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1964 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 1996 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 1468 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 388 wrote to memory of 2088 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 2252 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 2316 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 2328 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 2336 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 2488 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 2548 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 2580 N/A C:\Windows\system32\dialer.exe C:\Windows\sysmon.exe
PID 388 wrote to memory of 2600 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 2624 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 2972 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\wbem\unsecapp.exe
PID 388 wrote to memory of 2984 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sihost.exe
PID 388 wrote to memory of 2072 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 660 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\taskhostw.exe
PID 388 wrote to memory of 3088 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 3392 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 3480 N/A C:\Windows\system32\dialer.exe C:\Windows\Explorer.EXE
PID 388 wrote to memory of 3612 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 3796 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\DllHost.exe
PID 388 wrote to memory of 3952 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\RuntimeBroker.exe
PID 388 wrote to memory of 4188 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\RuntimeBroker.exe
PID 388 wrote to memory of 3680 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 388 wrote to memory of 4036 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 3156 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 5016 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 388 wrote to memory of 2100 N/A C:\Windows\system32\dialer.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
PID 388 wrote to memory of 4680 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\SppExtComObj.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe

"C:\Users\Admin\AppData\Local\Temp\3974c5d0b92366bbc9af950c8d7f898d.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\ProgramData\Google\Chrome\updater.exe

C:\ProgramData\Google\Chrome\updater.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

dialer.exe

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 randomxmonero.auto.nicehash.com udp
US 34.149.22.228:443 randomxmonero.auto.nicehash.com tcp
US 8.8.8.8:53 228.22.149.34.in-addr.arpa udp
MD 45.67.229.122:80 45.67.229.122 tcp
US 8.8.8.8:53 122.229.67.45.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 20.231.121.79:80 tcp
MD 45.67.229.122:80 45.67.229.122 tcp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
MD 45.67.229.122:80 45.67.229.122 tcp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

memory/4512-0-0x00007FFA332B3000-0x00007FFA332B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50biuvp4.ufo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4512-1-0x000002322EC30000-0x000002322EC52000-memory.dmp

memory/4512-11-0x00007FFA332B0000-0x00007FFA33D71000-memory.dmp

memory/4512-12-0x00007FFA332B0000-0x00007FFA33D71000-memory.dmp

memory/4512-15-0x00007FFA332B0000-0x00007FFA33D71000-memory.dmp

memory/388-17-0x0000000140000000-0x000000014002B000-memory.dmp

memory/388-20-0x0000000140000000-0x000000014002B000-memory.dmp

memory/388-19-0x0000000140000000-0x000000014002B000-memory.dmp

memory/388-18-0x0000000140000000-0x000000014002B000-memory.dmp

memory/388-23-0x00007FFA52050000-0x00007FFA52245000-memory.dmp

memory/388-22-0x0000000140000000-0x000000014002B000-memory.dmp

memory/388-24-0x00007FFA50D30000-0x00007FFA50DEE000-memory.dmp

C:\ProgramData\Google\Chrome\updater.exe

MD5 3974c5d0b92366bbc9af950c8d7f898d
SHA1 1b141b9cced64d1b86cd9d3460062ee7ecd34357
SHA256 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820
SHA512 6b786fcf6ad40c3f8007e55242db7794f640177f3394a49a3ac9dc3b6cf3588eefe8e3db8ed21d9fcc3962de50d48c6c28867ab92a7da324389e19b9642170fa

memory/388-28-0x0000000140000000-0x000000014002B000-memory.dmp

memory/380-42-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/1164-70-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/1296-81-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/1296-80-0x0000020F0E9D0000-0x0000020F0E9FB000-memory.dmp

memory/1212-78-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/1212-77-0x0000018A5E7D0000-0x0000018A5E7FB000-memory.dmp

memory/1204-73-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/1204-72-0x00000189AAF40000-0x00000189AAF6B000-memory.dmp

memory/1164-69-0x0000027F4FCD0000-0x0000027F4FCFB000-memory.dmp

memory/1156-67-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/1156-66-0x000001B930510000-0x000001B93053B000-memory.dmp

memory/1072-64-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/1072-63-0x000001FCEEF70000-0x000001FCEEF9B000-memory.dmp

memory/956-61-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/956-60-0x00000258C8890000-0x00000258C88BB000-memory.dmp

memory/404-53-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/404-52-0x000001B0AD7B0000-0x000001B0AD7DB000-memory.dmp

memory/432-50-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/432-49-0x00000160C4560000-0x00000160C458B000-memory.dmp

memory/960-47-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/960-46-0x0000027ED05D0000-0x0000027ED05FB000-memory.dmp

memory/380-41-0x0000022EE9BA0000-0x0000022EE9BCB000-memory.dmp

memory/664-37-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/664-36-0x000001AD0F400000-0x000001AD0F42B000-memory.dmp

memory/612-33-0x00007FFA120D0000-0x00007FFA120E0000-memory.dmp

memory/612-32-0x000001BB1B530000-0x000001BB1B55B000-memory.dmp

memory/612-31-0x000001BB1B4D0000-0x000001BB1B4F4000-memory.dmp

memory/2484-315-0x000001A57CDB0000-0x000001A57CDCC000-memory.dmp

memory/2484-316-0x000001A57CDD0000-0x000001A57CE85000-memory.dmp

memory/2484-317-0x000001A57CDA0000-0x000001A57CDAA000-memory.dmp

memory/2484-318-0x000001A57CFF0000-0x000001A57D00C000-memory.dmp

memory/2484-319-0x000001A57CFD0000-0x000001A57CFDA000-memory.dmp

memory/2484-320-0x000001A57D240000-0x000001A57D25A000-memory.dmp

memory/2484-321-0x000001A57CFE0000-0x000001A57CFE8000-memory.dmp

memory/2484-322-0x000001A57D010000-0x000001A57D016000-memory.dmp

memory/2484-323-0x000001A57D020000-0x000001A57D02A000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 00930b40cba79465b7a38ed0449d1449
SHA1 4b25a89ee28b20ba162f23772ddaf017669092a5
SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512 cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62