Malware Analysis Report

2025-03-15 06:45

Sample ID 250124-ejq2lsykf1
Target UZI.bat
SHA256 6eb1179500bba11bb328612e0938cd5753d6569a45882a0ecc210f29fa5a7d54
Tags
orcus defense_evasion rat spyware stealer bootkit persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6eb1179500bba11bb328612e0938cd5753d6569a45882a0ecc210f29fa5a7d54

Threat Level: Known bad

The file UZI.bat was found to be: Known bad.

Malicious Activity Summary

orcus defense_evasion rat spyware stealer bootkit persistence

Orcus

Suspicious use of NtCreateProcessExOtherParentProcess

Orcurs Rat Executable

Suspicious use of NtCreateUserProcessOtherParentProcess

Orcus main payload

Modifies security service

Orcus family

Orcurs Rat Executable

Sets service image path in registry

Executes dropped EXE

Checks BIOS information in registry

Loads dropped DLL

Indicator Removal: Clear Windows Event Logs

Checks computer location settings

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies data under HKEY_USERS

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of UnmapMainImage

Uses Task Scheduler COM API

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Scheduled Task/Job: Scheduled Task

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 03:58

Signatures

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 03:58

Reported

2025-01-24 04:01

Platform

win7-20240903-en

Max time kernel

150s

Max time network

130s

Command Line

winlogon.exe

Signatures

Modifies security service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP C:\Windows\System32\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection C:\Windows\System32\svchost.exe N/A

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Tasks\MasonUZI.exe C:\Windows\system32\svchost.exe N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\System32\Tasks\MasonUZI.exe C:\Windows\system32\svchost.exe N/A
File created C:\Windows\system32\perfh007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\PerfStringBackup.TMP C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\wbem\Logs\wmiprov.log C:\Windows\system32\wbem\wmiprvse.exe N/A
File created C:\Windows\system32\perfh009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\PerfStringBackup.INI C:\Windows\system32\wbem\WMIADAP.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe C:\Windows\Explorer.EXE N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TypedURLs C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\Explorer.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\lsass.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2d\52C64B7E C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\My C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "2" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 5200310000000000000000001020526f616d696e67003c0008000400efbe00000000000000002a0000000000000000000000000000000000000000000000000052006f0061006d0069006e006700000016000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 C:\Windows\Explorer.EXE N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION C:\Windows\system32\wbem\wmiprvse.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\SCHTASKS.exe N/A
N/A N/A C:\Windows\system32\SCHTASKS.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1652 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe
PID 1652 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe
PID 1652 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe
PID 1652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\system32\SCHTASKS.exe
PID 1652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\system32\SCHTASKS.exe
PID 1652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\system32\SCHTASKS.exe
PID 2376 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\winlogon.exe
PID 2376 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\services.exe
PID 2376 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\lsass.exe
PID 2376 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\lsm.exe
PID 2376 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\svchost.exe
PID 2376 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\svchost.exe
PID 2376 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\System32\svchost.exe
PID 2376 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\System32\svchost.exe
PID 2376 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\svchost.exe
PID 2376 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\svchost.exe
PID 2376 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\svchost.exe
PID 2376 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\System32\spoolsv.exe
PID 2376 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\svchost.exe
PID 2376 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\taskhost.exe
PID 2376 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\Dwm.exe
PID 2376 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\Explorer.EXE
PID 2376 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
PID 2376 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 2376 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\DllHost.exe
PID 2376 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\svchost.exe
PID 2376 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\sppsvc.exe
PID 2376 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 2376 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\SCHTASKS.exe
PID 2376 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\conhost.exe
PID 1652 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\system32\SCHTASKS.exe
PID 1652 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\system32\SCHTASKS.exe
PID 1652 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\system32\SCHTASKS.exe
PID 2376 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\SCHTASKS.exe
PID 2376 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\SCHTASKS.exe
PID 2376 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\conhost.exe
PID 588 wrote to memory of 1368 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DllHost.exe
PID 588 wrote to memory of 1368 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DllHost.exe
PID 588 wrote to memory of 1368 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DllHost.exe
PID 2376 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\DllHost.exe
PID 2376 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\DllHost.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 488 wrote to memory of 1652 N/A C:\Windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 588 wrote to memory of 2976 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 588 wrote to memory of 2976 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 588 wrote to memory of 2976 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 2376 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 2376 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 836 wrote to memory of 2040 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 836 wrote to memory of 2040 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 836 wrote to memory of 2040 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 2376 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 2376 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 488 wrote to memory of 2976 N/A C:\Windows\system32\lsass.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 488 wrote to memory of 2976 N/A C:\Windows\system32\lsass.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 488 wrote to memory of 2976 N/A C:\Windows\system32\lsass.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 488 wrote to memory of 2976 N/A C:\Windows\system32\lsass.exe C:\Windows\system32\wbem\wmiprvse.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\UZI.exe

"C:\Users\Admin\AppData\Local\Temp\UZI.exe"

C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe

"C:\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe"

C:\Windows\system32\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "MasonUZI.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\UZI.exe'" /sc onlogon /rl HIGHEST

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "2125966296-930637785-264461089-1316351472178431578912011714131837109561-187152744"

C:\Windows\system32\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "MasonUZI.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\UZI.exe'" /sc onlogon /rl HIGHEST

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1331370171108381278-280160360-34379452614909468887545384-74996174422882"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Network

Country Destination Domain Proto
NL 195.88.218.126:10134 tcp

Files

memory/1652-0-0x000007FEF53B3000-0x000007FEF53B4000-memory.dmp

memory/1652-1-0x00000000012D0000-0x00000000013EA000-memory.dmp

memory/1652-2-0x00000000002C0000-0x00000000002EC000-memory.dmp

\Users\Admin\AppData\Local\Temp\iaqqrxfp.p1p.exe

MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

memory/2376-13-0x0000000077021000-0x0000000077122000-memory.dmp

memory/2376-11-0x0000000077020000-0x00000000771C9000-memory.dmp

memory/744-75-0x0000000000C80000-0x0000000000CAB000-memory.dmp

memory/964-100-0x0000000000BD0000-0x0000000000BFB000-memory.dmp

memory/2376-152-0x0000000077020000-0x00000000771C9000-memory.dmp

memory/1652-144-0x000007FEF53B3000-0x000007FEF53B4000-memory.dmp

memory/668-92-0x0000000000410000-0x000000000043B000-memory.dmp

memory/1112-82-0x0000000002230000-0x000000000225B000-memory.dmp

memory/1072-79-0x0000000037060000-0x0000000037070000-memory.dmp

memory/1072-78-0x000007FEBED10000-0x000007FEBED20000-memory.dmp

memory/1072-76-0x00000000002D0000-0x00000000002FB000-memory.dmp

memory/1020-73-0x0000000037060000-0x0000000037070000-memory.dmp

memory/1020-72-0x000007FEBED10000-0x000007FEBED20000-memory.dmp

memory/1020-71-0x0000000002010000-0x000000000203B000-memory.dmp

memory/964-69-0x0000000037060000-0x0000000037070000-memory.dmp

memory/964-68-0x000007FEBED10000-0x000007FEBED20000-memory.dmp

memory/964-67-0x0000000000BD0000-0x0000000000BFB000-memory.dmp

memory/472-66-0x00000000001C0000-0x00000000001EB000-memory.dmp

memory/744-64-0x0000000037060000-0x0000000037070000-memory.dmp

memory/744-62-0x0000000000C80000-0x0000000000CAB000-memory.dmp

memory/668-60-0x0000000037060000-0x0000000037070000-memory.dmp

memory/668-59-0x000007FEBED10000-0x000007FEBED20000-memory.dmp

memory/668-58-0x0000000000410000-0x000000000043B000-memory.dmp

memory/472-54-0x00000000001C0000-0x00000000001EB000-memory.dmp

memory/428-32-0x0000000000C20000-0x0000000000C45000-memory.dmp

memory/488-27-0x0000000037060000-0x0000000037070000-memory.dmp

memory/488-26-0x000007FEBED10000-0x000007FEBED20000-memory.dmp

memory/488-25-0x00000000001C0000-0x00000000001EB000-memory.dmp

memory/428-23-0x0000000037060000-0x0000000037070000-memory.dmp

memory/428-22-0x000007FEBED10000-0x000007FEBED20000-memory.dmp

memory/428-20-0x0000000000CD0000-0x0000000000CFB000-memory.dmp

memory/744-63-0x000007FEBED10000-0x000007FEBED20000-memory.dmp

memory/488-48-0x00000000001C0000-0x00000000001EB000-memory.dmp

memory/428-43-0x0000000077071000-0x0000000077072000-memory.dmp

memory/428-38-0x0000000000CD0000-0x0000000000CFB000-memory.dmp

memory/2376-12-0x0000000076E00000-0x0000000076F1F000-memory.dmp

memory/428-15-0x0000000000C20000-0x0000000000C45000-memory.dmp

memory/2376-14-0x0000000077020000-0x00000000771C9000-memory.dmp

memory/488-212-0x00000000001C0000-0x00000000001EB000-memory.dmp

memory/1652-224-0x000000001BAB0000-0x000000001BB98000-memory.dmp

memory/744-225-0x0000000000C80000-0x0000000000CAB000-memory.dmp

memory/1652-227-0x000000001B890000-0x000000001B910000-memory.dmp

memory/668-226-0x0000000000410000-0x000000000043B000-memory.dmp

memory/1652-228-0x0000000000CF0000-0x0000000000D4C000-memory.dmp

memory/1652-229-0x00000000006A0000-0x00000000006AE000-memory.dmp

memory/1652-230-0x0000000000D50000-0x0000000000D62000-memory.dmp

memory/1652-231-0x00000000011E0000-0x00000000011F8000-memory.dmp

memory/1652-232-0x0000000000C30000-0x0000000000C40000-memory.dmp

memory/964-240-0x0000000000BD0000-0x0000000000BFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabCC94.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/1652-325-0x000000001B890000-0x000000001B910000-memory.dmp

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 46d08e3a55f007c523ac64dce6dcf478
SHA1 62edf88697e98d43f32090a2197bead7e7244245
SHA256 5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512 b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

C:\Windows\System32\perfc011.dat

MD5 1f998386566e5f9b7f11cc79254d1820
SHA1 e1da5fe1f305099b94de565d06bc6f36c6794481
SHA256 1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512 a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

C:\Windows\System32\perfc007.dat

MD5 19c7052de3b7281b4c1c6bfbb543c5dc
SHA1 d2e12081a14c1069c89f2cee7357a559c27786e7
SHA256 14ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512 289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83

C:\Windows\System32\perfh007.dat

MD5 5026297c7c445e7f6f705906a6f57c02
SHA1 4ec3b66d44b0d44ec139bd1475afd100748f9e91
SHA256 506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc
SHA512 5be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d

C:\Windows\System32\perfh011.dat

MD5 54c674d19c0ff72816402f66f6c3d37c
SHA1 2dcc0269545a213648d59dc84916d9ec2d62a138
SHA256 646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA512 4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

C:\Windows\System32\perfh010.dat

MD5 4623482c106cf6cc1bac198f31787b65
SHA1 5abb0decf7b42ef5daf7db012a742311932f6dad
SHA256 eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512 afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

C:\Windows\System32\perfc010.dat

MD5 d73172c6cb697755f87cd047c474cf91
SHA1 abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA256 9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA512 7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

C:\Windows\System32\perfh00C.dat

MD5 5f684ce126de17a7d4433ed2494c5ca9
SHA1 ce1a30a477daa1bac2ec358ce58731429eafe911
SHA256 2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA512 4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

C:\Windows\System32\perfc00C.dat

MD5 ce233fa5dc5adcb87a5185617a0ff6ac
SHA1 2e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA256 68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA512 1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2

C:\Windows\System32\perfh00A.dat

MD5 7d0bac4e796872daa3f6dc82c57f4ca8
SHA1 b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256 ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512 145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

C:\Windows\System32\perfc00A.dat

MD5 f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1 961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256 cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512 116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294

C:\Windows\System32\perfh009.dat

MD5 aecab86cc5c705d7a036cba758c1d7b0
SHA1 e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA256 9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512 e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8

memory/1760-487-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/1760-488-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/1760-490-0x0000000140000000-0x00000001405E8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 03:58

Reported

2025-01-24 04:11

Platform

win10v2004-20241007-en

Max time kernel

723s

Max time network

750s

Command Line

winlogon.exe

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Suspicious use of NtCreateProcessExOtherParentProcess

Description Indicator Process Target
PID 2408 created 396 N/A C:\Windows\system32\WerFault.exe C:\Windows\system32\dwm.exe

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3792 created 396 N/A C:\Windows\System32\svchost.exe C:\Windows\system32\dwm.exe

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" C:\Windows\System32\WaaSMedicAgent.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\system32\wbem\wmiprvse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A

Indicator Removal: Clear Windows Event Logs

defense_evasion
Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx C:\Windows\System32\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\svchost.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Windows\system32\wbem\wmiprvse.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\631a2839-6d75-41b3-8208-209d15cef915 C:\Windows\system32\lsass.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 C:\Windows\system32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D C:\Windows\system32\lsass.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\Preferred C:\Windows\system32\lsass.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File created C:\Windows\Logs\CBS\CBS.log C:\Windows\servicing\TrustedInstaller.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\servicing\TrustedInstaller.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\system32\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\dwm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\dwm.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\System32\mousocoreworker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\System32\mousocoreworker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 C:\Windows\System32\mousocoreworker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\System32\mousocoreworker.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\System32\mousocoreworker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\System32\mousocoreworker.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\System32\mousocoreworker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\System32\mousocoreworker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\System32\mousocoreworker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\System32\mousocoreworker.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\WerFault.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\System32\mousocoreworker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\System32\mousocoreworker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\System32\mousocoreworker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\system32\dwm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\System32\mousocoreworker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\DeviceLicenseUpdateFailureCount = "0" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02xhkkriycidaqod C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\dwm.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2045521122-590294423-3465680274-1000\02vykofsqhkcdfvj\DeviceId = "<Data><User username=\"02VYKOFSQHKCDFVJ\"><HardwareInfo BoundTime=\"1737691134\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n" C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property C:\Windows\System32\mousocoreworker.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1737691213" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WaaSMedicAgent.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2045521122-590294423-3465680274-1000\02vykofsqhkcdfvj\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02fcyzceuqjvfcsp\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2045521122-590294423-3465680274-1000\02vykofsqhkcdfvj\DeviceId = "<Data><User username=\"02VYKOFSQHKCDFVJ\"><HardwareInfo BoundTime=\"1737691136\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\System32\mousocoreworker.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000039281a63756db3418208209d15cef91500000000020000000000106600000001000020000000c463a368e8fd5062ae6730f39d79b1fd4a8c8dd0bd1f15cff1d8d79030724556000000000e80000000020000200000003b6ca3e717b672f2424d41969cc54e9f31e1bae8b62f481efcd978e53ea39704b0030000ec020458d9d797430f3f843e34183aa85d4d563112c6d47995dd459c45e2877cdea5345d049d63db2faddbbac9ae6beb4d08a24c5433bddf02a0fd9b3c8af3c7c38a20ee476b64e62e1bbb36fdfaea02d06d28834365d7d490bcbc79285afdbcfa584e0eff2be3ae251bb83a2960b7ca06f07d013de7a0153df5a24c90ff609971e5950dfe852a73fa947fdcec15fb6ace2f98412ae477b353654c25b4f67e4a65304cb819e5ad3670afdf0bddce913de0c7528ceeaa5417c7762f693ec0a4d711ff6ed8b514f2364ef74931b4e24cbf7fd0520298736342a6223408e003864df3b3d7d067da7e46427d0e09ba3a895a387e7c2839ab7666b67f1b99a5338b68c88815408184117b02e14c02abb5e79be9318fc68af8e23a317073f117925cc7d4a38474eea9110109ed97b95408f16199dea2eed345e5e9a4dd6d42dc55a345ce57e55afe0d2e441671882cb94880f1ffb3de9dc15f6574f76c03f6639669ecc4ea9e183159d80d903ddbc5da941a79ef6c2489122d6f7a348548e4ee2d65d2794d2885e45cb37b13c79ba748da02c4b3f6496055f20a73c7ddd6eeb103fdea2519bbd0fe6c73b5dff3f096bcad8ddeb0a943a5fdec6a57bfca761a915931b5a1ef71bb17868111ce37dc24fecebc8f2cdaaecb5687dd1b65bacf90e36cea08d03149ba85a408ef316f5d1a0a3d36b1140c903a25dc79d073a6ca2aa2a400103a7aaf2750d5d847338361279cee7f01092395a9a9dd50da4e4519b00757e3e18d6496a7d8b5bc1409713af5be0846f2d713184127c20645651a6b1bcc77ca72425dcac785b22d1b142e58929839f45cf94372b8a7de7bab7f06ebc35135234a7d7ced44ba917bf7d98b3d300f5afd1b5513b257f0921dfe7f0970df06b89d5c206c9f19d04739e9452af5fb5c60e60ba1e5c3bacc616893393eb4e5d3e86490a29d612e5ca9320dde4ca9f445c45f7524be7682456450c65e2a4797b158990f998acda0df51dc2f568cc9bd12056e3c2ecc2f4b381372844ce6f5bc96fca2cd64442ed3c134b925ecb185e5ac562f5f7c2d5d226148a40647ec8f8087e6310d784a29015d7b3e2d8a696dae193e97a2086b716712ddc0a3b251fbff06360b00a957b087fb363d77e09df924f06396fb28f5102ad55d209657f6a8606da4cf94603cc8e3f69d2fbedeb90888bfb3ea8c7d7909ff315cb614cd60ee9d976ea0bcff4a4a0ddecae9ee228166fd1cf905cc25d592822e7d62295a9661fd57ff0f58ba2cd293784369523891fd84a5468ee94f0f006314f40f791dd698de411ba98c8b1b6ebb24992149ba8cb932d184dc3240000000a234b21284a5a6978aa20531ec7751c64e5a3d87b531b513f5990fa632873f2dd8d167ea7cff1c30c1eca2e4dce7e6164e1c39a51f1bfd1c8d86f41750a922b2 C:\Windows\System32\mousocoreworker.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02xhkkriycidaqod\Response Friday, January 24, 2025 03:58:48 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtgObx3spkUaDMBQ8ZqdLOQAAAAACAAAAAAAQZgAAAAEAACAAAABV6qE8EwM2KagdrHcJ89aentNA5ijlUpbJOl+mf/odPgAAAAAOgAAAAAIAACAAAAB14IX7Kz8S/SWJRkOs2a8RgQvndiXPReCPZe3C9YR1zYAHAACdE/d8hG3gMMtJ2bC0dKktF5pi9PpwEVJbsfuj5QZ62Ox/bRXuogseFbud+mzqEm6+kotcF152vvaOvbFrAgos+68QH0Ju9empJvfKuOtZUo615EYYCnUVgZgb6Klx4moUxq0Zgkhp7q6JjY5ujycfR9qtir1WKwEKPqmKFwEY8nWdY89mqaOKbrtZrZMW+DG/JOR4fygDaTozytU/X02FbEZbaehomzMzVAB5bdu1ZhSOqgDr502oO7FSV7aJobsYnts9LK7Bzt9wZgnjtEXjy0pNj5sCDIg9cfNQO7TCgrs0PtMyDSJtVvEvc32tRgrYgIK3l0UdQk+YWbKw5KXqf9ApUsL7uoqaNnmd5Qvi3JjhlsWcloUetK8OXGz/1cJeVpl7V5HAV/VS2AXqS0QcOX+O2UjwQZDDgd0Wjqlj47zzWEp8//CCxo9vwhnPJc62ay5chVGWAXbmrEiR+qLF04rppmRdedR+G3zAGLIGrhoO3m9VpqckrjaH5UVpuKbraP1rKmXo+KUDM+5MhBsgGXpuKB6reDdndzIVH+h66kILG2ZKoeoqn3JhG/RgmP/usqFf5p4GYM2CkXW5oQAvIbHjPwVU6rFZrGfWdlLytUZ1A2WBUvA3rps+s3Fu8C43eOgmmP5n6GXf7+E6izwsHHFHO9mLLpdqt6Aj8eKl5XEfIQX460Pb0M18L/Srz3OgTjhx8slouIxk+/KB1PhnCmqI6w4JIZEKaW48+OOpKGzGWOD7gCodwunPVAGYP482SwIsNlIWBe5F3nkg6UYWAjsm01bORGToRIPNMR1NM3g48lZeDub6Nvg492PBqHRGIxAgR7IlJck/8QBoxoRW8764OMo4+el5LcbvWvJksKP4Dq2YX5ObEXNmgmo/4XU2w2ke9SZ0YPOHpPeQ/tSZhXZBJfjZeQ4e0mEPM3ILWEexcbjC+m2jMSP7J8VMtmmBuayfBkDXPgQ6/+lXYvxCJ15/Yz7kFKleq3XJdxHQ8dScX41jcsMuxtcBsu+yzUVvM8jHsLC3726FmQKbN6tidZaFXV5kCpkLHhxAA7tnljOmgL2xw395S32GURZHevRIvZjatls+IB95Uye++O+pr6y6/VjWpdBlMkGDWW9oVYgWDirh7hWfivS8wHtMjPTz3SgYwbD5cVFnUynGGsxEC/SgL54tdZhvIR8KGFPSRt36xfXa5zZK5G5Ma7g/LSPwPHqPBbpMggc9anE7UIF+f8JiK9YHN6I6jBxHjA+e3pv5taKl0/hOrfRQuTHXJAHou3Xanpk1Iw7BF+Pzu/WgQ9zWEhsSkIhgMh/4pNNjHpJc6YdOdZoC/7vn0h0JjBFemNDa3oj35jf8jL3HyxyHj84MrcyVR5UNfVbjc6Mgu9nSSrIzM+2Idh3L85j0kWACAAB6PBdXBPgTHLQFKHq8dqi8m7HA4m/kntyuYrPcoI6Wq7SxuaODPgIEXAVh6xo7KHo3Gb7MeiOpXj4PYcaLOaJPnhGbhzr+FFU9yHVe1G4HwVH3Pvye9RBSET839jpvoVwGnZJ8kuLso62pSzOjoRqVyRMIrLQs0qy47URczdRtYG31Z/HmurQlkebUsd8EWGL9fxh1ypUqok9J6g40zXs26sXWJoitadjovLnIfulIlY1GqDSriekqAY4yVbug+ty/ZEvxYr6gPQlp6DEcp5qBKyPiChImGPthItFhiStDL0OkGiAY7tZsQtRUHiphwXjWghNLbWpGnA/1gtsKSD28sthq9g/yF7uFcdEEJYHfMaB3+37XfNH0oBTJHuClTPqpNnvfjwJCVFFpkNbx+csSauTvgq6rAH2Mpz8siOU7LPtzEbsUpSUTe27It8C6nSt2eKCcgMWs+sbWWwdI70Ie/ByYwQpTO9t2Eja/BV/nR+gGAKM6E3PY17vduUAbD06Fwg9Vm++x1Kt1VhM5oZwN5I5JNIpQ674vKAOv9VAiX1xk7qnBQBaPetcjxzPoGyXR+GVCpJOTtbZKmc07RQ7kwGJh3PSOmNh3/5kcOASZpAtrPax9TQU1J9t2IXP8Vb3crT00ZL7gHyGSmvv+zEoMxEfuhgPqLeSvmM7v41V5zAuH9p7nEPkNUlTyEPo8oWZFvWjE0VEnDlFrLcWgbiDwv8IpJhKjP9YQ/H/0ApXvKL21/nNaS9UBVC1maPSVPhlMl3QgbZVqSUEX1AZ0Zs4xYqMYoaVFRwRYLrM0//ZzI0GENyGROHICaz9RmJlGw2IESkFR/a0OR+NFYGUeXj1re4Ns4QGrLQ8tFO48VOpMQjxYlGZZImKtL/uLPgfa3EmvueZMz75E6qBYG4vkQtyVC1pyiNf3tej1LGVWJO8ZPIfZkCk13lDJqsI+27uU77ajcUMS5asMLbNMbus4hGzgx1yzGVja3EB6NlDX84crAnyGWNDXiSEUJkkRnTRbNsBOzPA9thCvcK1zhjSCVX4oqiAjz/Ubd4lrtJNR7U9pGYRJfLtWezoYQi7yznn8HrQ2R1Myly3ylUsOvhNMqWJffTob+jCMy7TEcBGacD2bJaX66TY7zpK+t8P7gzBAAAAAkgEGXfDXkeTZtGnvNYuf00kpB0XlKv2suSzYppFfqv9NTrJI7TD+pvy7ob0SstPNpsWYGVIZvNhUaJs4Zg/Slg==" C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02slpyrjmxqojasl\Provision Friday, January 24, 2025 03:58:43 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAOSgaY3Vts0GCCCCdFc75FQAAAAACAAAAAAAQZgAAAAEAACAAAADe9zeStnO4ovvShsU7pvwOEMGFLh0J4Mp9DQT16oHhiwAAAAAOgAAAAAIAACAAAADKj/A6wsoOExlmLE0MZ0RtQxOhD4gKuiZwJkjXCQ7fKCAAAAAjBpiGyZLA978F59R/GmcYvHMaABtEjmFMdmUfEQTVn0AAAACGWytbBfmpQJ00dl0z7FW2NWhrjcEqa6O8O/1HJVQ8BgiA6GlUiOf+zadc326KEXd5z8kThf3Qy9xIbzGrwYa5" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2045521122-590294423-3465680274-1000\02vykofsqhkcdfvj C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02fcyzceuqjvfcsp C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\dwm.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02jufgdisfqtpvux\AppIdList C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore C:\Windows\System32\mousocoreworker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018001231F88657" C:\Windows\System32\mousocoreworker.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek C:\Windows\System32\mousocoreworker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02slpyrjmxqojasl C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WaaSMedicAgent.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2045521122-590294423-3465680274-1000\02xhkkriycidaqod\Reason = "2147780641" C:\Windows\system32\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION C:\Windows\system32\wbem\wmiprvse.exe N/A
File opened for modification C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION C:\Windows\system32\wbem\wmiprvse.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\SCHTASKS.exe N/A
N/A N/A C:\Windows\SYSTEM32\SCHTASKS.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Windows\System32\svchost.exe N/A
N/A N/A C:\Windows\System32\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: 33 N/A C:\Windows\system32\dwm.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\System32\RuntimeBroker.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4824 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe
PID 4824 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe
PID 4824 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\SYSTEM32\SCHTASKS.exe
PID 4824 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\SYSTEM32\SCHTASKS.exe
PID 4620 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\winlogon.exe
PID 4620 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\lsass.exe
PID 4620 wrote to memory of 976 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\dwm.exe
PID 692 wrote to memory of 2572 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 4620 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\spoolsv.exe
PID 4620 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\sysmon.exe
PID 4620 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\wbem\unsecapp.exe
PID 4620 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\sihost.exe
PID 4620 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\taskhostw.exe
PID 4620 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\Explorer.EXE
PID 4620 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\DllHost.exe
PID 4620 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\RuntimeBroker.exe
PID 4620 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\RuntimeBroker.exe
PID 4620 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\SppExtComObj.exe
PID 4620 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\svchost.exe
PID 4620 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
PID 4620 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\DllHost.exe
PID 4620 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\RuntimeBroker.exe
PID 4620 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe C:\Windows\System32\RuntimeBroker.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\MusNotification.exe

C:\Windows\system32\MusNotification.exe

C:\Users\Admin\AppData\Local\Temp\UZI.exe

"C:\Users\Admin\AppData\Local\Temp\UZI.exe"

C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe

"C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe"

C:\Windows\SYSTEM32\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "MasonUZI.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\UZI.exe'" /sc onlogon /rl HIGHEST

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 488 -p 396 -ip 396

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 396 -s 3504

C:\Windows\SYSTEM32\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "MasonUZI.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\UZI.exe'" /sc onlogon /rl HIGHEST

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe e723163ec8431713387ee4b240fb5fe7 B8oxsRWli02s8d7CCcCStg.0.1.0.0.0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 195.88.218.126:10134 tcp
US 8.8.8.8:53 126.218.88.195.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 244.160.67.23.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp
NL 195.88.218.126:10134 tcp

Files

memory/4824-0-0x00007FFCB63E3000-0x00007FFCB63E5000-memory.dmp

memory/4824-1-0x000001F6864A0000-0x000001F6865BA000-memory.dmp

memory/4824-2-0x000001F688220000-0x000001F68824C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ajhxf1eg.0mo.exe

MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

memory/4620-11-0x00007FFCD4850000-0x00007FFCD4A45000-memory.dmp

memory/4620-12-0x00007FFCD3B30000-0x00007FFCD3BEE000-memory.dmp

memory/636-14-0x0000014B90590000-0x0000014B905BB000-memory.dmp

memory/692-19-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/976-31-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/428-38-0x0000015218FD0000-0x0000015218FFB000-memory.dmp

memory/1036-60-0x0000010900AE0000-0x0000010900B0B000-memory.dmp

memory/1360-71-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/1360-70-0x000001A5513D0000-0x000001A5513FB000-memory.dmp

memory/1344-68-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/1344-67-0x0000025B75F90000-0x0000025B75FBB000-memory.dmp

memory/1232-65-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/1232-64-0x00000248FA0B0000-0x00000248FA0DB000-memory.dmp

memory/932-59-0x000001F1391D0000-0x000001F1391FB000-memory.dmp

memory/1216-57-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/1216-56-0x0000021F71C30000-0x0000021F71C5B000-memory.dmp

memory/1128-54-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/1128-53-0x00000256813C0000-0x00000256813EB000-memory.dmp

memory/1048-51-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/1048-50-0x000001CAD2FA0000-0x000001CAD2FCB000-memory.dmp

memory/1036-48-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/1036-47-0x0000010900AE0000-0x0000010900B0B000-memory.dmp

memory/932-45-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/932-44-0x000001F1391D0000-0x000001F1391FB000-memory.dmp

memory/428-36-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/428-35-0x0000015218FD0000-0x0000015218FFB000-memory.dmp

memory/976-33-0x0000022A11C40000-0x0000022A11C6B000-memory.dmp

memory/976-30-0x0000022A11C40000-0x0000022A11C6B000-memory.dmp

memory/396-29-0x00007FFCD48EC000-0x00007FFCD48ED000-memory.dmp

memory/396-28-0x00007FFCD48EF000-0x00007FFCD48F0000-memory.dmp

memory/396-27-0x0000027A07150000-0x0000027A0717B000-memory.dmp

memory/692-26-0x000001CB830D0000-0x000001CB830FB000-memory.dmp

memory/636-25-0x00007FFCD48ED000-0x00007FFCD48EE000-memory.dmp

memory/636-24-0x0000014B90590000-0x0000014B905BB000-memory.dmp

memory/692-18-0x000001CB830D0000-0x000001CB830FB000-memory.dmp

memory/636-15-0x00007FFC948D0000-0x00007FFC948E0000-memory.dmp

memory/636-13-0x0000014B90560000-0x0000014B90585000-memory.dmp

memory/396-23-0x0000027A07150000-0x0000027A0717B000-memory.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5D0.tmp.csv

MD5 12e86ecefaae066587ccb1199b89df63
SHA1 24fee9c8838483b95bdaba81814cc6a7bf4df8d6
SHA256 26887828c2fbbc944efde08073824652e68b85f0284e535baf4e31513f3364b8
SHA512 0c07fc5050050719de0537d73a8dfd8b6f60ab2da3e462d592738872c1630afa142a5e7b8d484e479029c668cf40d826cadad81ea4cd6fdd78b06ff7a1dbb4df

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5F1.tmp.txt

MD5 00bc7923f2e5ca2f9b212a31555d0320
SHA1 f8ec0b643bb71330e8e35302743d02dd0c4cfbaf
SHA256 a57f8602a558cad813e6fe889aeafef602ad0d3065a46baca54625009a17e402
SHA512 94b81bd40ea19e05775f55989511ef029d96dead0c4269f3127a8dbcca179c168c427c88661b0b2ed7298864bf3c8e87b8933361b70b4a92217306a55ff872f6

memory/4824-364-0x000001F6A0E10000-0x000001F6A0EF8000-memory.dmp

memory/4824-368-0x000001F688250000-0x000001F688260000-memory.dmp

memory/4824-370-0x000001F6A0BE0000-0x000001F6A0BEE000-memory.dmp

memory/4824-369-0x000001F6A0F00000-0x000001F6A0F5C000-memory.dmp

memory/4824-367-0x00007FFCB63E3000-0x00007FFCB63E5000-memory.dmp

memory/4824-372-0x000001F6A1820000-0x000001F6A1832000-memory.dmp

memory/4824-373-0x000001F6A1830000-0x000001F6A1848000-memory.dmp

memory/4824-374-0x000001F6A1850000-0x000001F6A1860000-memory.dmp

memory/976-386-0x0000022A11C40000-0x0000022A11C6B000-memory.dmp

memory/4824-391-0x000001F6A1A90000-0x000001F6A1AA2000-memory.dmp

memory/4824-392-0x000001F6A1AF0000-0x000001F6A1B2C000-memory.dmp

memory/4824-393-0x000001F6A1C40000-0x000001F6A1D4A000-memory.dmp

memory/4824-394-0x000001F6A1F20000-0x000001F6A20E2000-memory.dmp

memory/428-395-0x0000015218FD0000-0x0000015218FFB000-memory.dmp

C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred

MD5 63df09ad2e7a275d5e007870f15bd7f0
SHA1 14e9a8480035f21ef91e07cf1bfbe9947217a6d0
SHA256 3762144e3095b45006bb2a2be77c8b0a12c0ddd9336ff475d83c8ce2c31647e3
SHA512 8d4bca48be0852909132fff5041c65062f6844aead1dd04d373a0d4c3552989d63affff0baa388eda406f11a7fab32ee491f1df50370498eccb8202547270605

memory/932-455-0x000001F1391D0000-0x000001F1391FB000-memory.dmp

memory/1036-456-0x0000010900AE0000-0x0000010900B0B000-memory.dmp

memory/4824-508-0x000001F688250000-0x000001F688260000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-2045521122-590294423-3465680274-1000\Preferred

MD5 69578b121326d5b34f321000ff778ee1
SHA1 fa16a399127d5e137679a2375f42b7ea4b61b798
SHA256 c6b3ff526c8b29934112cc8eed70683fe5fa14516ee063dca6a272678ae50b86
SHA512 4561feeecaf72ae82beaed87b42104e43c2d966f228441e5e5968a64e5b88198e9889e17c979d60188f96c698a6f6386efa53137cb45377b696f6631c7c9a7f2

C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

MD5 1e8e2076314d54dd72e7ee09ff8a52ab
SHA1 5fd0a67671430f66237f483eef39ff599b892272
SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

MD5 8abf2d6067c6f3191a015f84aa9b6efe
SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

MD5 f313c5b4f95605026428425586317353
SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 856b4f8354711aa475d0ba20cc5c2229
SHA1 13cc34ca82a87ea76ee2991baf805662ce4ae823
SHA256 66022cc962abcfc30d22f43a45dfc6df64e2b3661347171a5618e8354c76ae10
SHA512 55340eee19ecc253484124ab4ecbae84f887fef3349cda6644e9a3510c9d8725beea4b00d008d66d358c3c09907d55360e301219bb9171cfd63394d3c05a7c89

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

MD5 2608cf7d6d92b4ecc1fec9a31ffbca4f
SHA1 f28961640f11b2f5b6ae19b6ae6fa314f630c403
SHA256 c2cc21319b12db3f0130f0f46bd075ab3c63ec0d3d1043aa31d16ea5592f7b1d
SHA512 c0c706670bb600764aae58bcb4af8ebc523b0397670d120c1264947cc07a4e4740d256b17a8c5149172a1c491f744143d47a5104c9096aa7bbf675656cbf6009

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

MD5 c02431ec580e71ba9837e01fac561a08
SHA1 d050875a11e562d0d36c5b7f878687c812ff3ba0
SHA256 2829e4830976c441532acf5358aa91c85391dfb340d0130afbec109b87ae0e31
SHA512 f7a5ada5a0c635a0fc7b8d548b294573f84c38035cac88fa49b12dff9c2e3bcdaeea27d52f6312c30b20ed861521a1f82849c8227bf8129213f754e598f02d19

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

MD5 df6a1897acc8a668ed3bd6e6a471e437
SHA1 5f760b900500609ef3d56a511a793dce2a5494c4
SHA256 afdb8c71ec3d3993abafc22d2812119e24370c84e3a65f3393e212a75ee1ed84
SHA512 6057f0b14bd90cc3a8b69f2f9cffdcf595a024c9c48af61193df5b153a9bf51b0dce2870aea7dcbc0d700d6f09f924d825fb280321241678f54303ab6ed2061f

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

MD5 ed6d57d6778fa926f981ebb288a4fb88
SHA1 2d58c9e675e8236f427ed99c8811b34bb20251b9
SHA256 0de1818e0d77821921b0851679d1c465d1be4bfcb4b082881a65dc9db6c2feea
SHA512 f05620508f4e6229f3d2c7a1834bd5282fa384a4b0374a55f7581eb2c9c7bb8ceef55d108c48d223e7bb437cf67e0608b9e560dda5221934bd43b4c0027fe603

C:\Users\Admin\AppData\Roaming\Orcus\lib_7c04bcf8b3a04c3c8433437cb1b3ce73\SharpDX.Direct3D11.dll

MD5 2a85c26e799957c835631784bd300509
SHA1 11b97075dc3971a6dd5a17a3e79425c7b90d7957
SHA256 5bfb0ab0867043f2e121034cdd842f1c34a6aadf3a02b10efc4dc221121b681b
SHA512 9e503f6d0ebe57e021f551544330bcb25d589fcb2f5a5f4b1578097e82c3cdb0977edeafc867f0210c12ac31691664cd835f291c1e25b12abe747cfd2ab2cce9

C:\Users\Admin\AppData\Roaming\Orcus\lib_7c04bcf8b3a04c3c8433437cb1b3ce73\SharpDX.dll

MD5 ffb4b61cc11bec6d48226027c2c26704
SHA1 fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
SHA512 48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9

memory/4824-852-0x000001F6A1B30000-0x000001F6A1B74000-memory.dmp

memory/4824-857-0x000001F6A1B80000-0x000001F6A1BCA000-memory.dmp

memory/4824-862-0x000001F6A1BD0000-0x000001F6A1C2A000-memory.dmp

memory/4824-867-0x000001F6A07D0000-0x000001F6A07F6000-memory.dmp

memory/4824-873-0x000001F6A20F0000-0x000001F6A2244000-memory.dmp

C:\Users\Admin\AppData\Roaming\Orcus\lib_7c04bcf8b3a04c3c8433437cb1b3ce73\x64\turbojpeg.dll

MD5 b36cc7f7c7148a783fbed3493bc27954
SHA1 44b39651949a00cf2a5cbba74c3210b980ae81b4
SHA256 c1ce9a872d33fb8757c59b5cd1f26c93b9eeec3e3cf57162c29a0783e6222a38
SHA512 c987c689ecc2cc57350c74ee22b66cb543535bc17b790016ec6407c3d02c539a727f5c38e1451a201e8e7ccfcb4d4639780b6e68cd38b7e67b1b28034ad738a2

C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk

MD5 eebda33e30f765c3e46b078aabf68feb
SHA1 734f59442a2e5986cc7aa854bfaa354b53b3bdb8
SHA256 70e5a47a2a4ed92b38f4545442d30905b348cfcb5e23fe5b91ba4ecd0cd90dd7
SHA512 d105694239275b971ffc0756f0eaf5b81f200684660f113771696b65c3ade27a222a65442d7f06960207124585076f1df1347d0f7b65f240376dfd421322b537

C:\ProgramData\USOPrivate\UpdateStore\store.db

MD5 1b3c7fd9cef6b4cdd8e96f09f3645b1a
SHA1 9aaaa6b2526909d946130516600b57e11effe3b9
SHA256 583901af8f0ae50f1ba1a1d2a5d9fc6bc1bedd964b708d9efd75a9b4dccd7f24
SHA512 18640ff4e34ff10e008b2d92441dfb208d2fdafee8d5a33ec4bfcb5118b92228d3d6593a1c1de1aa50bf9f2bcb85fb47d6700e830a97f556fb356747fab09307

C:\Users\Admin\AppData\Roaming\Orcus\lib_7c04bcf8b3a04c3c8433437cb1b3ce73\TurboJpegWrapper.dll

MD5 ac6acc235ebef6374bed71b37e322874
SHA1 a267baad59cd7352167636836bad4b971fcd6b6b
SHA256 047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
SHA512 72ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081

C:\Users\Admin\AppData\Roaming\Orcus\lib_7c04bcf8b3a04c3c8433437cb1b3ce73\SharpDX.DXGI.dll

MD5 2b44c70c49b70d797fbb748158b5d9bb
SHA1 93e00e6527e461c45c7868d14cf05c007e478081
SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
SHA512 faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0

C:\Users\Admin\AppData\Roaming\Orcus\lib_7c04bcf8b3a04c3c8433437cb1b3ce73\SharpDX.Direct3D9.dll

MD5 934da0e49208d0881c44fe19d5033840
SHA1 a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
SHA512 de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59

C:\Users\Admin\AppData\Roaming\Orcus\lib_7c04bcf8b3a04c3c8433437cb1b3ce73\SharpDX.Direct3D11.dll

MD5 98eb5ba5871acdeaebf3a3b0f64be449
SHA1 c965284f60ef789b00b10b3df60ee682b4497de3
SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
SHA512 a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2