Analysis
- max time kernel
155s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
23/03/2022, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
86587a8aa1e46d2f5cdccfc0a2b7147d69c680d62f65a464acb3a4297acd15bc.dll
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
General
- Target 86587a8aa1e46d2f5cdccfc0a2b7147d69c680d62f65a464acb3a4297acd15bc.dll
- Size 668KB
- Sample220323-k5czrsfffr
- SHA256 86587a8aa1e46d2f5cdccfc0a2b7147d69c680d62f65a464acb3a4297acd15bc
- MD5 b94f937fa219003219b590aae14c8adf
- SHA1 7cb6bff771ace61047f4b7f69bf5a2f082db4c8c
- SHA512 cfa0f01ed150e7163cf4d0855a218e75785af32da16f78a6a1aaabdbe57f9583786801f97467a1f75fc393e64e824541ed4c61a8a90c1784dd5804d989b4334f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
165.22.61.235:443
-
121.78.112.42:8080
-
216.10.251.121:8080
-
195.77.239.39:8080
-
195.154.146.35:443
-
68.183.93.250:443
-
139.196.72.155:8080
-
194.9.172.107:8080
-
196.44.98.190:8080
-
128.199.192.135:8080
-
5.56.132.177:8080
-
78.46.73.125:443
-
87.106.97.83:7080
-
66.42.57.149:443
-
37.44.244.177:8080
-
190.90.233.66:443
-
203.153.216.46:443
-
207.148.81.119:8080
-
103.41.204.169:8080
-
104.131.62.48:8080
-
185.148.168.15:8080
-
217.182.143.207:443
-
198.199.98.78:8080
-
103.82.248.59:7080
-
185.168.130.138:443
-
202.28.34.99:8080
-
59.148.253.194:443
-
37.59.209.141:8080
-
185.148.168.220:8080
-
54.37.228.122:443
-
85.214.67.203:8080
-
85.25.120.45:8080
-
118.98.72.86:443
-
103.42.58.120:7080
-
78.47.204.80:443
-
202.134.4.210:7080
-
93.104.209.107:8080
-
2.58.16.87:8080
-
62.171.178.147:8080
-
45.71.195.104:8080
-
116.124.128.206:8080
-
191.252.103.16:80
-
54.37.106.167:8080
-
88.217.172.165:8080
-
54.38.242.185:443
-
210.57.209.142:8080
-
159.69.237.188:443
eck1.plain
ecs1.plain
Signatures
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4CC1016B-6240-432C-8055-8606563DF0AA}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E5287397-D076-4B3E-9B00-3EDD10AC2EA6}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat svchost.exe - Modifies data under HKEY_USERS 16 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000246a78acfdef184306ef9e30b5c72d058ddcfbca12257b1ca994d098ad094bea000000000e8000000002000020000000fed0243f79bdacd0e266d39e322054c263cd874864ba92d23ba250d8bc8054a4100d000045e012218db86deab7853364f92152b324af0396d89d5588c316ea39ce49e28eb089f4609389537c7d77f9723540b2e5ee3272bc5b15c87b2169a024152997625de39edac39e82ac6f7e2ddabfcbe8df2f671a479b94f997738cd29ba8e594e25dfeda12304e4efe6aa4cfa97cda3d01d14e02f456fa96bb6a4c6c1b0ec20d93f0831b7c9ac31408318d5294e434aee970a551c75e080b7a6721132bda6209d2f2a0c9efa05ab335c0106622e3923a6f65c73d6655d9d9390cbf25d2f7d1158f12496dfd89afb5484a13cb0a55a9577cc17867204db334b8f294540b291e9e7f3d54e6d01ec7d0d68390fc2604c91401c8fd8bb532b61fa0e0ed5308f223005d6014e2038a974fcf540a68c8ce7754df6360efb9ec6a0067cd8b0b7bf5c170e685b605d251cb839385eb4b1049e98fa3cc89ad64c996f9b7f2716c87feebd4f7ca8fed4d5492fce1436924217e2bc61a26edc9aea7dcd7c8c1159ff48e470698da16d44f6ac2b45d405776f2a767ae30d4e718cdd933e95403f7846f0e40c7bd1c5fbe1ff830efc75cddf62417739363576dc737fc4e4de04bfa5b938a7c76c1a42346e3255c2998918fb27567f5115cc3ceee1369165906a1a47b6dccf914db2c8ec3dd4b5bb13d6bf8d4771c8b74c852829d50327271c9866030ac79442ab8f0fd54436a0555aa7bae2ed8b212d9e1b33eb0c93e1ea8a7f2c481b4ad951694eff6a338875a098ab4c3e71581c61b28bb6317baa59faa84faf86b16645b4c1ae2f9fd393b12c0ebe6666cd67d1a24a148a0c2b05ccbd7ad2aabdb4c74ceb314cbb5c1f3b281301e8607a40f57ba4cb72632a8e2b3ca2d8fc5fd98994e0963dba7ca1d92f6438a241918ee3b40cb623a51ec4730449e8c576284a6573c6b9cc3b1ce82222769cbf287f206517e2e6654da97e7b13b83b5935b187d8d549277e2d535e226ae02da95184c191a13c4f89f0c5f22d36d8c9b178a8ad39d3f82a0a8ee81f58d0ab96fa532175ea05897da341c4bb56f5cdad10911ac6a4989849deab35c993c08e787f9cac81425d5b663569b1949ba36061a539ba4dc6a7414baa1a2cce6a164030981d88a29c4de7ac635d98106a1875253fea29e94b7d9fe71186bc64be821a0f84821fbf3c5a247cb98461c3edc198c0bb6db1630faf0f34dad4d0ccb17def98780faea27fb25f016bd27fc942cdeb5c6b4b89f3702e859aac3f433e236ba24c947359368838822103ae6e6e11081ca05bf16a283f1dd7b73df3de3540f2246ea279661c566af30cd5ac62a2448bb3462f84f2eb51cb06477ad7fc400dc659d9aa596024f615543c32e6e3adf5cd7163dede77dea7106aeedb934ea6efcc00fdd0be4035c525bb35534e1bed0b7256544a32af3b327acae447b68b82b6f1d1c6de91e366ba3bedf0add86869479f92506646be2296176ef6c9227edb8679fbfa78c82deb82f8901f0fe03514e0f3268dc641665ed89f99c64f50fc68f8883b4314f8f14d35592f7a663c6df7a34bb3b567d90189c48c0bc1a01c7c32f96290d6aa84010a085cddcb9ff28230516d21e022c61489545e25f963867e4e8e8382513708540b723bdbb0c94e2897353bafdbb20fdf3407491d0926a56c951eb2be0e35e1172b3896cf0fd8c86565a61a4ea53a9f9ebe6c80f778c74a72d6a2be287fcaf5a046985a66006a553578ab518f93a99c44bb692b6d061dae1927ba42c2dfaa269e089f23cbb50219b3bad0723e5fbba4f15f5228e8b205342c923308205b11c37a4a0ae6cc685fa69d39556e6e4ffa45c2399f53b153d6a96a5a2864e7a3e6d695a3a62a2fd9be1dac88ecd37566530575af1bd1513a1ecfbba5471f095e88c5acad26f1cab63ce41ef9fbca5e9c9d1432f33ce3e00138e7d7aa605f8f41fa251760fdebb4a3dea75024533dbf008a8c57305de34bff270580756e8e48eff17509631945e40ea35967de34ab667e83bfb7f2d17cad3c7a13b4ea9ceacb9395fa044faa947bcfbf9c43f078e06cad67efb6be537b8070800511d1f6240ab71c184c10efc5daec9e54c7ff92d0c964b83197647371f3a0a28e6466ae353fabbb708bc75e017758173ca1c189f374b3cae665b43daf307217800921c106e9c344d6117f565b1996718d3edb748c641de5399d6bc08d322104810da607d4c418e077d6d7a6cf6c7afcfe5c333f709bc07a0dfd16c99602052cabc4fdf2f299343643a0dd52bbd09d5c4fcfeb7ed8984f10953929e9aa16c66da75f0dd8af2cb21af9592c4c38f1b0151390b263848674001bf86c147fb2d3ddad6679f95fffa51c88a042a70c71ea84b1f7633ef82b4afbf5d3adcdec085a965ec804cb0eae5bd64d9bac070b469d5a1483c14f6005da48ba5eb21046c9d7843efb8011046164fe31a36821e066eed1c8ce7673cefacbd3a5778384cb69d370779c597282f6cf09308823065ca5a0ab2b85e5b0fd3657acca54c90e6f790cfa8f177ab6d0ecf784cfd42f97ebe5bd9b4a93b4d21bfc05b8df9263b9f706c5f6c52399b63ae21f612fde84c5ce1af77e65313485f96451dad061f5e84456d3ccbe1c6316ee9f9ea4c4a51940aaab7e46224fb22a27033b7b6fa22612180a31a8849709c1f11fdd07bec2966ab7315a8840fb3a18fa02923cc3a67949e70b7e53f62a522365fa497082d607f361edac82fa2ce418edd1fbcba4d7de67908a816c764ae8b59a494454176fdf4c36240449c6119ac468c90efcb7726a93aa21eeac2724fff1d56614fc9dc702f6125c8e53e4754f2b340cbfa80f271bda4268556abeeb685cc2931bdefad397fcef30b6e580a01d53ce363a04836ac3e378e2526cafe1c63fe20aab29e7cb9e1baf713ec48a2a2eae2be9ed28c0bf32f87bff31d7ff6fe723c5414a7917e3c3409acd1222576606e65fb2751b3d98fd5bf1b2ce5ff8d9ec9334a349fde6a9b54ea71dcfcfc3a527fc7ce3fb38dd52c4fa44fad5aabf64f3e10cf85cc0dbf5d7d5946d4b39076ec1b88913709727b56279f84155a0dbcf9245d9086cea26396bcfdbf7a2d7276f998f654d8eaee9897fa821d0bd543316f8ef9758e887f6b96b4a025e1cf25298056d6d5d7a84572c99e6f3ad42dc81062e02cc2cc708b2fc59fc28861a2e2918f5aac024782ae24ad2b4bfd51a64c914d7e56e04819aba44f9e949ecaecbc3e551162b6819941277eaffccaefceb1fe9909b41b559354db81198c4ee0dd6a3abf87e222f3754d7f781e8393187ac5cb24a47cd03b5568642acb88838852f6fb4f58ad3262fbd4c9035f66dd7587d5629d60d4d3c7e7ce1e339cba4fc6372e271b2386ac9bfd587f729ac9fd519df5469dea9f43b69b5f5f9ea3b4428526004449fadd44854376c83eff78cf1671bacd45a24187398121a01a9adfd4a7870576a5f8ee9ac6ef53c4de0c0b7afa6b401856c4b242de69bf0759977793fc1dd7cc46aa3e1ba2f19f5c05a746f9c82998b675403563696ca1ef07d173257585eab47b161185163888693b9a8765c423d220ddd27909dcd97ff09c8d587cde78bfa99be58066745dc13eba38587d64fcec87f0e4038b8c273f7aa21243958d81b087e936c4bb422b4e7eed449a53414c84c33de763539f669b597c9ea6b573030e422842421f2d8bd40d41f73c0f1f66b0d6fbf264335a44a86863898fb136ab49d1a16ca0573c4b1460f2824b532ff62404f787e4dc1dd745bc0920511ad5b690868d3cf3bcbf77cde0ae50b6b7c2ccb5c5413de7b9fdc193293f443675134d3fa71122904c2ccadb7db19c2be6418d4c9f21552ea46c52ca7fce854f8d732a3ef071cfeef6dab0124ab9ec22272314bb59a8ca4919a2300cefda202b29cd8d141ad508ce68b19d40dc2494e8530b095fdedb6dcadd9666446d4420c432879e29b4a04009fb4641cc919771977eb8da3928a8d238bbae01a22287ffc8bde6c5f82c9cde0eb6043151531367fc8827f75a6c03a29927a8712a1a0187cab6ecf9e0aa8be119c84c2334667c5ec892f894a78f13b779630f914d1d68ac00f6a2acc3d8f4d23e121e5d55cf6a82e2cbb1dd70b0eda8b0be5390bdeed37d43b075838ba3f9c16c9e993c6aabb5d3701ea00d14662c799d40dc4ef1301b16bd40515dcf4e6853233d5d7ddc6d6607e56cd9901da1f16d730b73522bce837a04377b01ef9a33134551603997c5f13de9731385c33d54d309c07d782c1b175de4e642fb91792bd37e13db4a89871b79dedd1fa52ba0a758a04082bfa90eca5f9844d3fa6312b275f2825461509994e794ddc557c34d4ec669b5d40aa40ba9ebd500491c6bc4000558073a12af36dfadb5f82890a85134cc5f647b4f98145e4c8a00e8cd69726273b85131484b9205e1345d77e55a58e529d4978f1f7c8e59f1fa70e5a685f633d09c825df64f26165b905c7f24b4f6597310d8e2e81472bf72367700242c430908b471db824345140bc5bb0923bab1a95a5f61739b5e6ed37f31702f17156fc56a0ecc4815e783e5bba204bc27a22c3f9efc8091142cefd8033b55b954314e8e4e729299cd0ad6f1465c269ad5f27117b3cc49e76f828495746801a81ffa61baa2ad8ea3864700fe963de2edddad665b1c460ca139d5bcbba17913aef48cacf2c6f8cda9850b2c5872b62986d7f95cd7f8c8b9f01b345e3396385d09ac0210eb0f00cbee4c556637721759cdab21f47b1f72a8624d420eff2493505fdd8140000000b20d4c4463614f8ce10a584a5967947bfe486bcb71c4ebda6713675ac2d30dd2645c244af301c37676b9ae31b19819b6a69cc4db768950b7c57d3de095d59b1e svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000002e78f7f402bf66bbeb21bef979e5ff298e36ba82e7b038f164f20f0706c8c19e000000000e8000000002000020000000d9ac709e67cca6b0e35491112963638dff99d791b159f98dccd282d6d9fae467100d00006becd4d1c35aef7dcfece438fe2cb3c0ca306b143d8c994623a534afc13431a87bfd17576f6f66d2d744d90998a6f4333122a61bece63f45bd626b6682e80f081834beefabc422aad31d8e31c2c70c7710aa8eb72320c878cf73612f690bd124436c76f2bbe180ae8eaebeb68c5b3907d55fe659aab8a1f9734e4359dba328d28648eaea56a7faaa550fc2f4cfd2de0ff7a33773da15ad6a086bd68eb259d5d576e309d34bf770847aa26905b52f6ba882a2d789305238b6b63685dfe3d6bd62e66d2fcd09a2c81bb9211a4d31371ea55f69733aa2c2c94755be3315bb85ffd3dc4025bb1019a56a801d10aa58514b8582ec8582b5890599c976b389eb9761e81454bc55ae05191c9de19405694524f608cef1d63a5c853798429a65010ca69d5ee02b910a7d349bc193a680daa2b50d732d3761752cd72a7553d604d4a207845431bb30b822df527105036cef47815bd8e7a3750ad1d5e8294106e0e5e271fe02a39fed6f07d2302bd2818aa9547db747cb28b3c7014e2d599fdb81ebbcc3122985e9789fb271cb68f6115647375656070e84183800a2358ff4f2ed0cafa6344febb30af17d2fb5fda0a7fcf250df01ea8f757c00c17a26319702bc2c4fb1c79d6df5f077cb9d37e303c8108991673cb8684bca918c19432d738c13372ff9d091d493468c9d4d5d30fd911cf2830033c4026dd568ed0621aef6218ba0f4efa4ec40d2b5881798e3b05d895f0a1bbbba2787e6d4816dafa93f66d73bf6a5f1bb3a8b15eb1b810fefc967bf9a8230d6351cc9a46f0d909761d407c263aa250b582402b05587156011bdd5ea73d1c9bfdf6df12e934cf0b1c46d3955bc27c0d8c8fdc30b8e29b29df6aca3a1b4e525e4cfe6b00f7ef8ce9b33d81aaa7b4648845f9b9a4560116c5878b418acab40184be24641ce4749474a35acb783bfc3d70c9c77c52796813545784113d5f596986f1232986b9dbb50d13ab52c9933f681b346df0d182d187027d4fcf490109b9d03157ee27d9c3e2a66dff8ff243dc9dea9b470cb2c8645ff9a08617f7704befc08f2069657deb672a9ecad76ca493ea447711709d26bb0b63616e2b8d26fa0f443760575bdfa03ed583498369adedc220733349642d49717b8859b17f67d99f27666bd0d7d616d195eafca2006d37875986465278c13994489925d3ea43cf6ffaec04de3fca1ee30940af3c7b64499bc592deb5305e73a1eba1a945f00ee272523fa1070371360de2dcd31a1aaf018d0263d31e8aa4592428423354bb0a250bc5091644d3f8ff2a3b72f96694e07d2afef110e00c3a71a42fae369e1124446d47df5555304fc5a141c9dc442531d074b4e24f4cf8ff6e7f6a960e83fefb05cdc62236e328f9e8bf69b7fd9daae77bc90ed939530ccedf76a4273cc10db50f1543000c3903ae7fc90ff17c7ecef1f3bf1653ef0a317ccadb5b5a890848322553d735098cbaf38cef5cf6f2fee7858e56b9b1ee87164b726bf23d3f8266323f36c003aa8247f3f7059359919b0b15c08323c7c5383359133beaa043e2a659167ad402df6cccbbb7b24f85b3bc751bcc7f949ed6751c445745d416cef232dfe8ab08dc6b8e5e7dabea7e1b0f795b4d3715447dc0f985cc980ae9113f555be669c958f40e4d11fc8fbacd6ca867560f965af88c9ab089c1fdda033dddd8d281af6cfb4b91566bc56f6de665efdae7f0856b8d4faf92afd56ad29b6cd0d62119dd7aadae0b49e0d3a691a5bc9eae467c76762d4c7a3e2267c4a9c6a64c911424c7622e6274b5b82f9b7c75949f10d8bb2d4abaff96c788faa4028c3640cc6988335fc58a4a30ce835528b8f68256653448af798500a5d15174bde907a7edeae10aa131c9110b3e74bf9c957a21d40c8f2e80bbeac7908d68abeda60d300268dde6b1d474cd730f78212415d3c0fde9e059f3e1cc28137ceabdd864d54bafe57d1937b783e9d7b8b5b91ac9339a56f83a68fc8300af58155aa3db5a11465f342363925c8736a88c3df6e296b288bb9ee1e841999a8c41b830546a8f99d120d8dc3f4554190454ae43c5ad1ad22b27e8374ca84c4fb6dc8dc834866ded301714dc7ae8218651eeb8af794e838db4a21001634740659983a25ecd7992c10661835b141cfd5864207563e0045e36b7c6e2fd39f4279c0c6d2b4dc77ceacb4bc2fd8f5efff505824200f0f2c5b5eea71b51e519867fd60383a710fd4af0f9f83eac51a860ba441334e14cc07ac9cd9bf210c681be6196f16ec7f382960f09cd10489f983f715bbeb33029857459cc43462e4b47be540be77d27b90fe7be558803fcdb7e1d9533167bcc8ff1a471b739f7e73412c68eb30a851ea098d9f0dc254dd5d2dee4bf28a7c16c6f231d3ad0f5616fa2d328e4dd8073d396559612111e00f802183408e84c9e0dc3cc85fa74ee56b684e931db476fc83bcd3d0b3c353ab64248148018195b71088bf8342fbc0fbc2855d493eff626ada54ff15573bd0ac4ae1836b74b0f95095d50b376009cc5473ff1c34171dea5ac1e30065f9252e6322776d388c6c3e524604c1175e64854958947ed5d8c95de8a285feae4a086f5014f98f0588bdd54a88d208e5b7bd970b6e683ebc950b08b322196b178ca058fffcae854e1fa8049018f0e50b1d86c5b27f37bcf43cc9766ce9011bb2cbb713aa8c6a5c911406b4a53468ee960054992297ad43e507981a1f5f56b0e363194680bf2bf3116dec0ab503f62504eacdf01b5ff8f5d3c9e5645ee022e4a65237a80bd8eae73e42c05be3839d4a64ae3d59dcd8466af368f816684208a912e9e26f404bc889037e8df29e371081ff52a537961e74861944231481d8dbbbc90cd7b26f1523f63aab7e320eebd43fd995a0ba8164671d03ef17f24ac789c368d661e6d64b24078b0b04b81dfbf709869e4508611e85f4bcd08ed0bb168297130badbd7a86d16419eb8a5768b08188d1f8375bf70d9924cf8d06a92b7277a9f7072878f3bb05423dac07e3373130f9e8fe9386815fb9115449a22712f1a0862f2cccafad29a48e1b5ec9c92166f9377d42c0d273e6302e14f4adf75d875a62870e196018c8dd038d50efef5c71b458029cc544faff7ba053b2d84c606d0f3e37d32f9e658b3159949fa757460b0e7321855f550f5a6d55bba853b935c55c24be13a071981d918ac96f588cec18f39966368f95310abb4da51a7ba3c5537a5c6a67ffac616f93a003ba127be564a57537484170e36f89e3b55b62b5537c85a67aebc4fb4077dd5c38ad9931a1e5a5bd89757aab180537b132e27fde3a92db0e6477db9bf8425cded4723dc055be6723f00eee6645dd4197f9eee55c2c191647fb1f1fb2c6785d30c3b2b0058e047045616c5cbf0783e1e5758a79055b87099d40beb27eafae46a0343464626511ed75c9be9ffbabf01d9548f18b121ea640dbf29d1951b8597366382d941f864d24c4d644133305664802c830169da5cb84e3a3b3150316236e7fe7cddabd8b9a6d100fa1ad1722896f10db7566480722e5fa921b512c0942712c6691337a35fec9672cf4aa4635c2e1798a9c81bd85972cb57ae1b522128f08a9615ab034350b9b43154c1e7887aa702d8e7ab8cbb81dc754a567c224b06abad27ba15bf6e5469a311a02c404dfc04723e1bbdf89cd42f21986d475af72c9b2a078338e3342aa0e3598929028c4046fe40a7c3cff5a46e907847dff428860e20a942018e9514bdaddd5cd5564eca149e69fcd19fe4fcd901606bf276b83c89cae82d0a064ad8a0462da379955292b6bc1ed915636bbbbb11cc45d0a57907d00917afc9a8b2e2cbd3532d4031dd2cf1d118e8ffd07da989423ffa9ae733496949e0e66cb8ddecb11766d52b0cc86db6f98a4c8ae65ac49e24af718fd6da062c0024009cfc3988284193a78bf618b3bea97f6e7d748db1e223a579b7d77c9e368868428466aa2ce70207dd7419af84e5310abe545dca2373dce3b5b52653980f64a8b32813144a4873d0d350a9c32830cb6aaccc11b1f8c1f4ded0a40777cd86372086603e8b5e176c305fe195288cf7fe5ea4207a8beef58788b0e243322bdda0f8db7935b0d7b415e70c9d218ce7705a68692fb868402f73b4b90f0ae2cb2177348fe8612806c86da52b76a1ce56e81f2ef0ea3c6729a9a36c81fb52052fe2ad4a2264c311bfd9a776f7fe43d7d7601eb06010b0cdace92a9bdbf1780e2eb90fdaea47d5e9d23344f4dd7a6365f8559154bfabb3b769a1d70474c645ba345680820c7bfb5c346026bcfa2a166a67b12feb899633c9231d0524638a52c7a4c5f666f45029609b124f9160d374519108b69997e928ef6c6b38ce9aefb1cd26aeec426c324478511579d48547c08fe6a5320d6148112489aab0951f6e01db37aca090492118ff46c108074b4f318585fd54059cd27dd354ad8e55d316f0ae3e9567f80375b63732991b7cc8cba8fe2a28ec8e8cab2ecec256ee4a2e49b3d4e39a812e4be7c2074c2d9aa48b234d7907feb7a354407922893fe462cb05ff5037fd8585e8ffb0d273f6476dcb0bbf53fa4252841595a48998164e9c362881788d6bdbdece4dca71504e6aa76565aafa120c7853f1b85d80ec1c3b6abf23f045bab17fd533cb6d249dc1931bc0ed42dba658832b260868b30030ce1f23519a0de2b44b097665c86d94feac6a69d9f95655884326eeed78062645cf6d5a1cae4b38f6f1043d8000340000000db8507dcbca9ca8c595c1242e4d0c38029ebe89859291ed90ef0ff4c2166b874c0878b251a39520d28c5c826fa52eff0bcfbe55d97eec786088bf46b5494ce90 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000002e82ba4170530b693165a444de2852d68c2b9bb1991c2b8fd73d34af65f5c9d1000000000e8000000002000020000000788da570bb4d970d240cce56319018e838e3b0a052da1fcc3ba8bed82a9f1e2f100d0000bd5c8274b9ebd272a675444c67344e5b35847b5be1ca9ea711dfc2a9a68743fb6849dd0ed80a764f8c0a5d892c442fe1bcf38a0d1df602f1256a516743953e587a05562b3f58f1c115e12311b5e06433838ee8055d9e0366eca61af92a80c73ce52cbb1ae4c42d4078a758eba0d2f91de87edd42b4aecf85d786cd078565ffb6fe0c856373e9b834b3f6b510aec297687fa5ee5d457309ab25fcf842a5ea1552ff4a81dc3c4c66b75e109f146b4199e59e607bfd6c8ddce54afc6d8b93fe2966a36c1e606f17129661be89637a5fc0756b1b112540c2694888890e855e57ae31da510bb23d0bdb12d324ce28b32610b3d4c72b0b914f9cb86b95ff837db00b6be998096fb6a52910ef02f3603d620b2cb4b34873413697056afac9653cd970a1401e59195d0baa6760339ddb684465b91a1facdf81d64d385e2e2f08d1e5b59784f37996e8ed705177752c407cf42650d91833d27a3b25e54b70c1750a2e1d05e40cb7610d5275479f435ae1db5ae3f3b882b0e04d05ca62948b124cc7d985a948c2126931978a29cce68cd696b2baca6d1a37c3b6a9bc978edb2ea180f7f81bc1a0f7708d300025afca724fca3bc1db3110e99c06de9bbc7ef0df8cabc092779eced5d1be0b9cf2036309fda3bcafaffb1d40f16d4a0b34002981c037dba36e5b48f4fe4cea72333552f4b9d23779a6d5d3f42a0f08edfe550c241ac50d4ee8627422f132a580edcdd58f15b9db0dfb6e931bbda146f6acd12ebd4026c59c6ed2a301367097fc07860a41543c9e9e74c105b84bb6338561ab141c976c86f7f43ce72e30dbc52b0fef2498f164d610bef7800951d38ee2a1341f26464980044d313ae7714ba97df4d806e3e97d8bd5a7c414700c99436c18bf9794cb69b934c0407d2b4e33e0187ef67b3971837a939d1b0eaaea3b5d749f1538ced70c69c52b8de537aa9f9768b89280c8a980c69c8643fb4e21cd19ecd50ea55737b0c44b26e458093c71ea470841c50d218afe82c30c1c2f361805f9b74969ef24ae015ac59c5e38fd90511973f606ac848d52ac56d5356a194ae2e4aea8fe3915a87571b42a58f6a0e9aa9c6920beac694892b89f31706f3721400e9a43084c28bf2b226db05f88e7c310145fba86aa2477690698b2cf33317988ade87620dccd666c6566f697c372124b219323e6c2d73aceced4829d11fabf3e8505ec466f570012e8c2401ac29f0032ccf27307a9cb8e8e680d1778c761bc53f1d15549600f5fce21d6523d939b0f68c63e52c8259197c4c5838bba310a41af9cf3d651d85521f76359dbce71d662740601ea28aca45020b71afa4cee683da6f83caf78ba515eb0fb328538c7463843f52cb5cf46c5efe6f4e626d24305d62e11fbcead67575a04b3fdd980df0d4a1782f6a42cdb3fb3bf6141934a0b0304af9104546d518373646bef60ab47067f3e9119407c3346a39f5f3e50d5f3670153b7a3b9d8494af89e443f2755563a8ef5d79e983082de3ed0685f0b4260adee2a9a6910f42cb1e25730169c7176f0bf07ea8cb3a8b27a8c059275eddcd55b1bb2643ce4cb1cd0f017355917ae364295ace28b6946b20adbe93b154b35d470486dca4eafc1e0abbd307dff575d81894a120c4b8c1f658905e929959488d5346b4083371777fa5c668ac93f1dbc0c3c4f21f5954d8481c44d08723fbaa6db886f1bfed2c6b7f859c9d0ffb33c68baf5a669618381b36dcbfc0cbaf7111b2a4f3c93eb3ea326d7a8bcbd554f8e90a38bacaf0c6d6edc12261856db70f497abb1ad52d06517085bcc99c530afcd7b6a85f85309b16ababd991dc9020f9386260d446f07d08998dbb05b6c85dfff5669c358e656159aad55190eee6bcf5f626a5f3cf19511551fee08907b8b0b9496f5ac757538367500119fdf78ab93a21f42f2fedb7779c77a605b8a0c5eee1407ba059b37744565e2038d55560d4add94a5cfef603be20c7492ea2c01bf53932d66487e2c4e3ef6031503f9f1be9fd856311da5971591b69fb50eff2ef595ba0a2350f9909138c91c8e9bda468d0ed6d21d6a5ff60398fb152f343762627ddb44070f4bc214a877b98cfa79b89e1dfa56b06d74a9515d9ac51dcc5f771a7a4b873bbf68e0b0bb16655a21fc89889ac81d8ce85690d577fce76474d6358b28c614b98b42e2fd939560ada021e6965a967c170b7750597f157fe5d97e791322e109386d7ff30058e3a8be7e14ab42e351467e30fd33a22f33da6080a300e95f30ac23c77526a4646f0f7a717ecfb88d3d3787d12b72d73be2ab7e6ff27072cf3814cebfdc60518d05af5430571709aa1a0190417588e2ab55bc66424f5ccdb2bb3ba9409e3ec3688874bdff2f8d2b194996a6edc95b03d039fa4633ca90b87507785e5b0d4e4178d91171b8a7ef4e7bf1e29f17836fa588cb439314900d185c66a3fd1cf629077993b16bcd3cb20a633de18c759cba8088cc6adb2b2654c9ee43857d4031c82bf1b26a04a2f61824eef00e58859b107627b27f5e8fff3ab739736466e89e4037140c31ef56229d32be5d19d7c5743f9ffad5287859ba1715a49632e639bc4de57146ca773c492f5a7f59d5a40ac5849c207c01d7b5d956114b8621cddec8b959c56295dd61a365963fb30060f70da28b0294a0716d8a8588c485369d0695c4f5a43cc5f66090dda7b4369ed1f09773c8ef49b4f13556dcd9e27b37ed93a7e62287ee7854c27fa54561e1245605718b5e68495d6030c7d24bb80f82befd0d53293225ab6eabf0919379abf86d70b46f9bfddd0fd92bc39f38e867a0b2e4c734aa765aa632c6dd5efd854f8ee99dda42510cbc84c3e9248ab1bf00213f69073d973d4ca968780d1f587a078cc43436715d96f6f34000307890c92b98362708aa912ddc299aec35779ebc5a40bfdcab87b1fe95b8eb7aad60070a69670efc25c2a3527e127541c953092c6845b9a8b94d3f7868372963d7ff6123f7631648ac1eb79b068fe1791596edffa2b6474ee45a750426c41db33b7a1dbeacc4b22aa3cf2e4800fc820a9580f1452cd8bf0e8e854b5d55de4f7b8833c1bc2bfe4445ee0ffa7d042b491f6402974d608f4db36b7668da9a6a8ae578c9b6823d3f8836d16425680fc8e2c353511f3a363b8f30d4b0be6367822d3f581d6e5b1acd7995789aa6f0d6f94db89c59d3a7b4b25fa3f0aa2c5d4aebf923ba042f1d1dec5fcff0ac6d0a2e422d4fa2b19745705fd6d41aafeb0b168174ec209f9ac80dd8a193fe56dc4c811e6d2f58022ea704878d520e73a3df697d8791d24c8557aa5ae42b894b9c3073b8e2853639be8060a278c8fea2ec28ade13141625edbd9ee7efe69909b91833a4f7e03a9808260199e95bfe8dc1d5b7007442ec0d498a32d4957ae791cd4982d76599841df5054abf3bbfc10229b2e9d14ecfc2da13f8092ade9910f733f8465e96fa188b18509dd355655f634bda219eed6c065b366c2ac7cc5d25f987f26f1a8f53b340135f15701d93656ebb6cda081914660b097cd9b4935c7075bde7827c9adf5cc3de963278ee5ec0784d8129664c519ea6afeb4badafcfa003b83015756778801a4fd58dfff9742a1d683b0fb3779bb0684f7b6bc2c111a38eaf4448f5b84256055646d8314f79a02f80015a4a65b4888af57cb9d5102ab035922b9bfbeb6b5aee77b2790b3edc38e3cf07da9ab3928b4cf53944ba17c93be6eff9ff7687d271ba40f13c7817f26fb33c38215b54de2c5754bc33aa5880af2afe366e53618089634be5902a279d901daad66d156cdb9d8ac0e508bebf6d31cdb5f5e6aed276de57f02b75e029414bc6fb674c26ee0cae16d459a2d26e4c89a70877dc1d5514fdeb0ff10abb8701c3e54c6aade2365d0a55e84ad77c99ef6f204fc68f9219657e0044f07436f3ae791b99c60bcd2ace374cf4392c9bba8136862b4fd166d5e8dcaddaae3bfed98687d630a5f607ecdd1a75dd2ad14afe0016e6d09978378e326bba566e7e8fda666b1489ac65772ef1a1205fa2aa609baa6d9f4b9884ed10fc2b4db2e6feee457470648b82be3f6ec2935c7d2ba2ab16817ab343dadb71085e7908eea729e830259a4ac26307a176e0b5c4419b78792d90b34bf86dbc70274b9923297b31baf11faadeb2130ba5e7eb3eacd724b38e719e27085832b6741c7cce93ebb16e364c63982c83c49ee25456fb4b010da0f43dec9700a9ee699fee27a58f085cc068ab3b9449ae1dfb0216969a3bc0a7a4639cdc08322ebc7af01445e37b8cb32809541692e98ecc6e66994022944680a8e044d42cc02ef2543e212f81fafdf5c9a04d83c47f546e05367dcf79c334410a9a83f2579d25040c828da6f9d595f8a45e6342dc6bf5fce9591720c4afd4a821f133f53776d73be68c150d70c9a098d0b603030df735ba5a8f9ce892e6caa6fd82e3ff1d52bfb1116e404283143f442f8271195824984a45c4406eca7f256bfa3839c8a0fb9eba6e3e2d49af496d34d7fbe8e16520d74641a84beb4967635d7454a511624f014c50db84dec853cb963e5dd8baab5d3c63e788cef256b9ce4c4c64f90976c2275a70e867e93a321d15bbe97827c7e65c251c30baf3d6a5c8b5a2d92335b57888b9e4eb92f2c145eb8ef915fe041fae000178f00f585d33552fa87f6528673fde2ff7e9445f8f3d27d35d96fd8df79b73eda6e075fdeb8aaac09bc385f7bf7b86fdba82f15cc54eef884400000002716b555e743b14b0fbf0b2c77da663a9bf2d393c49d275d1cd1fda8030d9d2cb5c177621d4916ed8b2b9ffb0ba54a431aac3eefef928845e42805e905434c58 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400662570833 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000008e531cb049cde00b6cf19ae52606ad2ff8ebdd44a892440758bcc3a629587436000000000e8000000002000020000000803c8d03b2475aa4b8a43651df6b88859623638979def45d26a66dda643d7246800000002aee2cc8db3386901d4d5325e7b8014c12cb2486ec2d370ddb23c7b1db477e4d2b801010a3e4b9c519eb01073adfe845ecc58492ba0d514489e60234282d06fee8c33d4c62a35cb3f5b1ea93ad83586a0614bfe3c9117a6271ea27316669e933077e4ed3b9a72bb84fb9a9eb0b5fc43fd9d4fa8dca558a4a6c4ad5d0c31dbb8a40000000f826c43b6a5b2a993a43e607c36ff8254b3de437a7b2758e98545312a11baa44e908cbd9fa198d321b6c7d1fda98e3cc8c3cc7522d51d331607891d86299f8a7 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018400662570833" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000003f423491dc5e0b87ae96252748a29ba5d2ff08573ed9c2875095c836d996537e000000000e80000000020000200000003ef745e796533b4b37b54ea1385d3ddc147ff5b671df8328f582038010d3a42a100d0000105ac821045ac5efa3188cf7354090926e8f5f7749d4096925220783bad9a796ae4e6957acc805a0fec31f5c28b765b41de1eef60a26f566e511673a5130a2fa85805031011f1a1e8199da438d85433615d74822160e94324c8dc3b4175f7dc1893e573eefe8865d1070c28d32e1b2fb7a80af3c1c421b65408142e516521470140516c0c5bb722b4f3adc80e3ea8d6e7199f0c225561b60dd249525f73a5915d0fcf1d56facb729d3195c4da93114ae980f572a7473b670130b5aebccb2ae60bc5e717122fc3054e984c3c3f46f379aed5f0592952e0c5300f629d27a92305658cf8ad9a612c306a9253f9cf14604c335ddf10e54179b6b843fb05fc6601f2e6d8fb1a70376d92dba591050ab547204b37b2bcc6aacdd20610e80ebf2fa0f41f9fcf94b47de903716e30c94ce02cf9b38c4bcd635ecae956e6d35dc89e0a517a2b64a58ff9598e58e03ba54b5af4053d314e7851a45f9dd08faf4b01cb0e1bc58caf13cb79803d415c58f6a8e27e9df2d4f8134bbfba8864cbd7293357db0afa9b6dfd76c7fcfd35aa831cd7415cb8af258e1d71f0e4f1ddea8d6c7e6b29ef253aac67ba5a3f79888f73e40f6a7db83da26c8c2ac2f608de0ea128eb9a879596204b9d09a021670f947253d019663d232c8b6c11caf2cd2076b00e83b5f822b912bcbce971618a363b8cabf9ea01dfd45a5ba4ccdecac372d5b25f7719b562d157a360c9893c9c4033aeefb7e3c121c8b2ee55d5f865950a00973c5e2b62b891d01254c0d64854ede305382deaf445411b75bd37a2cdbfff2548f5b9aa9b838fd01f6fc08f36531da10cdde88cda874cf01b1738db6f508bee6d72361dd5f1ce9856c5016f470a0c8303d1e9df08d934231b0e6ce5328a76869de50af983f1ab596d4eef866ca843a3cebe28989f6476c69665dc2683532cec6f8b055f5603a06ce6ce72eca63975782f9c655a8865170ae0e3846a2faae04ac23f17bffb4ee23e68f97f072fdf0e5210f7adb5049ab888c9a2e66f12740a3c6696e3e8b8520f4cb38ef67a88aec786ba5289c20ea4f3e7b900c74f976bc9317475653c9afe43071f4515e8e2a98fff815def292b82755a4d75bc3f5277bb627ac1573772f519d322a7c9be8f130058c8a0e9fba9db21c63c345ea924d40d919813f60480ee98e62bfe34dfedbcfddfd60f793d9f0bf10bc4e74dc9cfe5fc2e37c726d2962f6a763ff438caebad49f153b06b475a261fae40e088bd5019157dec504d92374cd2652a3dbdae59cbe7380795d5aa46e97d2abed442a6bd657a749679dfb1bff5849ca09ca72eba108ffec3b76339f8a5609d5842904be5c2f878800ebbf6b6002ff6b0e1b514555aa5920ffbd787e641838af0a091570876fe4e6b4fa518639c984cc02403998512a0657981fda932278c3440a5abec35a043387190e276a0a64563358a0f20e46888c3bb9a0fdebb987df45da7504415a8e8125c65175bcd6ebd74eee9719ead7a951de7ffeafcb862f0d06a48f8dc97a9746951285205dfc1aaea7c670f242f43c375cf812da656b7918e85501492068e9e142ab5318fc68032943c81a3833ccb13173db5afc164cf8f98fa144b1dc685e3e25955b4d37d668b01b7f4ce51f841c681e8e5637e0b95db67a50741cdfadeece0e318e68867e66f6a0503195790f50d15ea627a9ce59b8d53b24cc864ca423b245d6dcbe1789340e1bfc31ed54b1a8f6c4b138f24f57b5de7511b88d26db2c12a887738b190d675243ecc575046b167a13d3587d337bfec35be001c2ffc154e318f8e9627b73cd885977a9f887f9e0273d7d9451732574cc2c9e5e359c6689239537a5d28d13057cbcfd1c952a3934a7eb63fc427f5cc1404725008b28799df3f98447f3006cf564a8851cb6b798c2431e527a6797b6bf300a90eae534189821215d1c5e7d8701e2180e3c03b70e6a6622fee52c7200188056247f138dbc9837163e078a2170fc6b5ba3d0c881565a9be09aff4938188f32542ebcd4b98f9be8e803412be644e68e7436d5ac3eff223e054d9d22b3f7b85ff4188fbb024b66de7b3496a3bf3928e5f8d44948cb9ee885e5af81a0d799cb2abdf48a01845ea07ce2e348e44fffd2dd42bdb6eb13c922a80fd723bc140f864d958340a0f8f1635c494b0346dfd05ad06e23306bb3403c30d3d55132b1d0138d3e60685975974560ec91e399c45c8c790f35625f842f726835f4601c9c29b97dad06a1a2ac4839f85fa677bb76ce636f1c9abdeb2ac3dd225455d603ddc5602f40c29ac1c33bfbd18a0bd2845c519900525825c341a4d058ef2705b6416d8e9976d1d8ef37574435b856244af74804e4fac30ba31af8adb212ca3a17ac9c1afd0e188a4951ef673d85db9b90799f4edf360c6299470ff39a77a33014d15fc61220715a492baec5559b421665ca2b9738ac61d18eb2200e0f156fb99dbc97b84bce8136ceae5ff760b8e30c5632cc5233bf55aefd35c5ef6f7b25056cc707ce0b27b721363b34e312d124db6f0543aa3e4f90deed4d57aa57c31f55f0a1de6a6a271e97d2b7830bdd77e5de211a4c144af2355bf5e397d2988df4d2f86dbf0458d9bab331fa8fa9b8fcad481a6a563f6539fc1fa28dad05d19037d808601eec347a4aaf26c02272479593f54eff96e97834815c9cf8a8fb74ede63cb30f77361677fc8bb81745ef4f92cb422a44e47315a805cb33a443bbb5e2153d806dff3f24d2c8e1c64c66fedd09b84af6ce25550f47d1e4c8fc1903d5c93715b43f2c3afe012183102b3a93da2c9bef1853a92b7ac3a8ffd9168edb3b60c5874e7fcd42066309e16763d5897679efc1f65d39195564fc4c30cca922ff4fed4f4592d24bf803400c2615850d739ba2508cf58ee5ee7a72656a13214ae13c566942eec5244e35a37bf45943de789bc20f8767b910162d88657c7b6078f4ff6973d6672d3034b1e282215beb61a444a726816c4711ea47837b08568c39fe589944ddea2bfd384ff4f17afacb26232f0cedcf62687ec09dce58a9653c33645661d8df32ca2367e57a5bdc25c89fcd7d79b1b530b3a15f91fb631d1b9ea21acfa6565ebc3b49990d3e2867f81434fbbaa76da94b57cc47002c752b1dab43b937187fc212b14f2858989c8875259106c46d7b623fe5fb204eb8ac648a2d9c3dc80efc674185507e0e4c63b3563cf7010b0d9a113d9d138931f3aeea986af1a1171aacf90adbf6a57c193d7b88999cc459ea6ee97660b22812acf1a4f84b8fb3bc0711212033fc9df80bece0681e894931e424b6d294065d00462a9f493672fd3731df659be2392fd1aa05b854c6862a35496b3f3d44ba58592f2c11966c2cca1279b086babe7759b73b3e55c9249a1fc7f67822441eb7c4a3b6e5926be4585d0db4c56f9e50242d16a828e4cd7e89ee77ebf9a80ca44323e0d173ccf5f3eee93f3bd66eab84b19e74d3d5fa7d3589dddb0496ae325004593e33af541ac32a8896a1cad0f2cd80e95bbbd23c6e80920dac19ddfb4d9a1f8ff39690f596ea144614ec47d65b3d327b9fc54c14746e30e64416448fafa4b3c9e31a159baeb52f87508484f6039c09ca811a103d612c1514b5828084aa38b447b2c6461567df18aa70399c0e53a62730e65e398b86012ddae37df360fdbd30fdb32cbae8cc6c04d5661b39238b3dd221b938829b4d35425b8bed96cd6c447aa07dd4fb9e715c04285ffa31b1e28a4d022ced601a6341bf10ea575e459a4450a3affe7801e9f0167c6cae3ab495074e75583f87f07e480ec61f6f830aec49f8b563922fbb3ee9f5c42924b7fa016e76f6922688bc42bda2f6d0084fcbb59b97133ee888bcf0edae561386f4ca9bf172df069eb540a89c83843001e336408d14a338640eeb689a17e009993cfbe7fa9399fa56ed35b83577fbbb6eb4a7fc0c334c0c605ca115a81533c52846dbb26e0cbc0f3ed8f41ce0ec0ad04b4daff5c7afcf4a685f49f6c31ac581541b73496ea63b116b5608dc350537161f231435bd54ee0c2a32459ec3a74b5da440467458d4f8d2a77ddbc5ed54b6ff3d6468c9980c3e6ed057a781b7f77fbeace4e45cd4b4917a22a796a9d5df1bf799315b9d53289a4b7f7e530e47bd43d685ed3afe26009d3e09ecc20e1fc139af70c3e11f2475e450f194543008cb166094293a746c61b5d448f866bf9592e63fb6d95fdc6aa152b2d0d197b93a87e3e95aa73ca016a509a9ae9512532b4a2051f0462a76611268c2c75fafece59fa23fe4c2cd0bfad5fe15791a3a7aa0296e93b466390ede8a4efb3bfe0a9f9df11af938ee3b71f19c2869d467f3cff88abc98fc6bfde61377670ebb53688244a21ef1bed6a7f99ec1f8f6f7a23d22833017df6fac4d06406e04a7651c25009eaaa31de4c26280a979c9bd234960c4a4971ea6bedbc7de94476a743f9ab8d46dd2b99fc5b6677f5a0a69fe285a6d40ae402c15c4495c65cf5777a1b8d4e5af99c82508407b634b960d21df1f6acc23a1f0a817c4f82089fb8f03de42126de493de5edd3dd803f43c4622472cff4f4fae3f4a962201b4bfeff38ad8ea6890d149cb2ed0de3699388722c88ce4807036b65e4009020aff4de368b42ac82ba51e6fa9da58cc2a5914f19bf3a959f8c885b6df2811eeb380b342b5732ea9ba9291ca6856693a60410a53407834898461397ec979bdb2fefdd911e5294089ba688a9686d93d5fe244df03fe400000000e7861eed5c8915b7fc61a7ae9731f53673b8fbf2db85dc1d7e8858ddd324f9a24854d19cbc9e91ddadf0862f75020d8db9fb36eae7cca6775ae6553967c1cd3 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400662570833 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000090dd0cbbd20a7662a62d8eea1dbeb7765bc63e3e5c39d00ca5ceac7f626bfdb9000000000e80000000020000200000004834f4b3cd3c261e93622f99c83484d31d7ce3b73af36893d6b7eab31c3df018800000006be9b799809f4a3b734cdac5901c3c631e8acd56bb83dd62723cd41ad61a8f0ad85c9c4cb1e5d91c6635768581fe8fee63a75871b27dc05d11c12c840c151d25c363a8b5d5b9ca53956a7a10a3ee3ed9446adeb6ddf8b8ee07d9589f02886ded92bbad876797c8016a67b38300fc0377977a019d9642352a4b08d5be91a8609f40000000a58adc656499f45a0b9e44c7799050071fbfc1a49e7f6be69ea4499ef49c0c10ff9842a484491a259673f10db0633f7caec2e44974f29300dd9e0a63308e1db3 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400662570833 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000d08f5768ed55e9ae50e9a5175d3d49974bbd0f1819b7ff4f5edeeeeb58091d7f000000000e800000000200002000000034aec06fe325f9f4f3cb272135fd61bc170db3db2ed59dc5dc4de242df5e1717800000004236d21212c536a69c2d7ee0f0ce0f03481c4d9c2ba1b09eb2b683ab7169c42a9dda6029a539da6591ecebba0a2e2da6fe5628d8b342613d89cbda818e9831a716e5f7ad7e53a953974b4de9de003b7337bc43c62a0e22475eeb098c16eae7e37f615037886241b50ebbbf9e7899aae874bcab26dfd93f18defe7805dc6d8573400000005ee983d3cb576dc70aa1bb6137d5d804ddea7cb73aa547aa3d6d202762c35191cbc4909230082064969f4b79d261cb7a23db49f17258581032be0b418a2c7c4d svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000009f702dcf019c4bd447280cc50c70099251a5e1ab62f8e44ca8e670b13e16546c000000000e80000000020000200000009ab31e3b9a85f5b689d7b5673aac88217df97d05c29c1733582e4e9afafcdd21100d00007c0a441acf5df692c531f5db1469af68dd3dbb57385c5a2d0204b2dc5c6808701c0013fb5c2339a66fe7992ac0840244129168619a134248cbb08cb337434eca63b8748464d803a93ab3ec9533f32648b5bab3661a897df8701edb2fcf1c4049890fcf0c3af3053bc133289763d0a272edb9af46e8c9c3e6f5b2004eabb055e24b0df38a5d4a50fb7a4b7d394b73771587bb17ca403beb513e32bf894b5150c3b4ee9aa034afa5bae0cf58ccdecf5053735f352ba52d2c9b74a769932ce8f693770b51a023e7a71b20866445f9a000329162d44d76102f82b64acb828296d209928ba375156397b669eade7eee685b303a814b99975adf99ccc36a06972845d09b774c97eda0ac2682647613449195bb0eadc8451a5c73fa9684231cce65e2c0939e72955ee69e1d202bddbf0178c9a391a9c91b0d16f1fb753cb72ebeaf19fec48f41aa2af6e1d6bc59c57aa3fe546a3d77862d37ac8d4b712a969916a84ecb4dbb64bcd6d16f0ffb5d866d06a936cc697556219a4e9a0abae3eb020e6e38eccd0b6a419f68a6337746acfd29e5343cc68336ea090971b91a057251c04b1e53e5d87accf5b6b65a21bc059afe345d5366af6a8e3695f984d96488faa8f0ee1b40f2a46385881abe97e085aef90297016b5957e9d6e535a2b349ed4c00a46e68f6632c23e683cacb2a0fb728535b2736e4a8c58cf7d0f1e6382bf18b501f3294b71e00b809b4df2981bf62999e2a7a0e29d65465b779a081345ea03c47e0841071cf97ec04f9e397477d23b219db2a788e433d8b36032538b3b41a8f188afe6c08eaebdca17769b8469d2ebb9876e07a86d5d1edd56535b8b8f20eccb1821f299d69cc693973eb9d235c87b2f1eb2ebe2301e54a207853aa64b8f90dd450725eb6011275ac013a4965e324f1d5341fac224cc52d0627d4161c2be8f0df9b88abce95f902e27f1ef6847a6b6f4be09715d3681f6a217209d1a8d4ab5e4bf540480a96347b86a5d719910dbc490448637b872a4f4a7586d63ca4acb46e7dba22b7e49ed35896b329c77478e65d360faff0f65a7d3552f7a9315c4028bad2655d99f306d9f090eade504cce562404dde306f1e8968b887b761c0089abd8efca367bd5c681b24c4f9eb796a36d34a9a06370981e3e6ac11361bd0ed066c7b3a412c3e784bd4eef10093bd8082edddc92dd03881a00dae31b54bcdad684c126b7d443b7a64e082ce0d55447501215b479a2aceff57f3406da98e8ecc3767043ba5078dfd27a3c4876a1dcc8679f277183ba8269c3fd1b3b06966401d4e2246a728462f07c0691a563fb32e61f39d8391407ec5cb7b167c6f5b56293ff998c37c1189966ed6d519496104eef5f1096e1d419ee1300fd06f141e76cbcc0734cc81f4dc3491926e5d7473530ad0f61e3bd6d3f8f4254a28c117b77d2f095757e032ffd21f81f39b2c35a74ba15a46fea92362cc7d0cdbb04e0490362bf277dabf1c6a3b2f8f9756c494d16440c6828ad6e7827e899f3f88e1fdbb704cd7fef4ca4e5b82b56988515ce17ee5e41c8839d7a0fe3d254db468733fb7ac79a8d7dbed9f83b2a794c7560c09953a4de174c5063d7ae9540a753f4980389313227c66dd69a685cceb1e2e48ab5243d7564062cbc16e628de0aa43a087f0b095bb911bbd0cf9a89dbf65275d9124f4b55c2fbe18e02d23e41e70e5f963b643ddfe07b4ca340ac94c751537245b6d796485ff9e92900e19a46b7d3858eadf809006dd8dee878ea87e3f8eb29f8ddf28ad14d2f71a25534cbd5c9994c2758d79e06b02a5ac05b391041cd3f31d70afd18321a45bdaa7582ff5eb2e3f1a4138fbaa9ec2e931a4cc63b8cc6442c7991141808544b3fb20a5df9a8890ec346b7010183ee75f2cbddf73f794a803b25791fe391312f9e792d38d8d3fb95b69db24456eb5af2a91b6d53cdb1f401fb52e04b87003e500168f01ddbb3486268b0ebfad39b9a1fa36b76c4c5114feddb65865ce035d6b1b2456ee5b5322a0d61e88511b7d1d2ba5a6acee2cf3cdedbc864ab1ad660530e58e1d20a9ada98a08f6a7d8645febd09127cdb4277e2dda0955ec7ad12d422d75ef89cd42ff5f275e8d87d9423e149a31c2c85d3daa621101a32a171e2babe96c3d2117e3dd635beb4e28cc2ee154e9490bfecfefadeb12fda1e0c74cc0a4d8899d9257b9ab5770d8789c0516b6e0495963aa57d25f96ce4535c1a980e5b76ac3744a6d89436602546521b4ec01816de3174f6dcd30c470a44c9dc110ee1310694c32d39254d1ca8ab44f1b18f395afbcea4a48dfa5f4ab0cdc50e49cdee76d7979129fec1982650af2489f6377c9e2034251387d5d2929f211852b2f25de45bce254995702f8deda0e1d35cc89832e13e7396dafb6898e01d8f8819aa0d86e752fe0c6079d1b0a0992ed277747a31221de1d57078e23e6978eec9e86956763d9fd3891c9ef72ef263ad22049ce3becbca9b8fbaa1a967e9ba2f3ba9f8fcdc3b55fddbab4f8be129047950d252c9f41523ed14e68c40f856d493cafa799e2583a1ee8facd669d6ea04eb7c2494af6b489834d99fdd1542603d015efcbb3c554148d553d2f786cdb1bf5aa0e0894d908fd9f03b80d3ac00ed051b00935037a4182547c51da618975d7a12b6dbc27b10a09d799ea2f88976f07a6f9f23950e2e961c8fa022439874ff3438954dece14d28d9298cab615aab81a6a2994faa313bbf84113a97be908d35874791515469f92cb8855804adadda370c17ac98356e214cc749f23392855b74f5e2f56fed6f07491bad81430e11369e24fd1434edd6ee08dab19194ece75e1bab940c742e5575f0bc2f5029a3642dbbbdf09bceeb8e23cce5f63d9ffb1540443d84f527f86b0e1acb40328d24fc4dc4dafadb474fc9e907589fad6cfd5759f6e288e12f62bf7a4aea25dc8450160833de71afba3fed9d701cacaecf7a5818c72237a656385117b3937df6c2b01f5e6bd4cd8c9c08d07ad3ac85bca8eb2e5e58ddde4d257632d827f1dfdfd73bf2dfcd02aaff1aae88f4513047e46f38e5abf2d6d685bd84d95af794d4c7b27e0122e2fbc474bbcac43a255219bd45c66f9d45442e32ca00c419ce444e3f9bd04c7f3a3caac6b12c780eb2d0e4c13267d8b318bcd014a34a7a44b340cb78b3b6e3622e7e59622d1b4d1490c5f52ab85681077278e49371728fc097e4683b7af572386135c0dae29503fe964218dda8f2f0e907b231de55884eeb703c3edb920255588ef67eafb18bc95757c5e4ae037f96fe24ef728e4131dd8da28d12bc5962419f33bc3bbab3a8aa9aeaa5a2a55cc61716e90e6acaa5fd21ca52ae6f2f71222f69d8166cb58dc243382d2b2be8429820bca3b81ddc17bd5323f108a6b51e216233f539e9b1fd58a7de29dab6c2727853648d9adaa114834fe9827585eaa6a47d2791cdb0354fb547357dbadc957fbeb548d740d535a89ec5271a4dbb2d776e11312677661b122638a6852149170aa0b8989fd9c7dd278fa0b5ed61b2d84fdc58db32297d1bd8b32da4300f7e6c0156700757a8fd554f1909720b7aae12a490ca0439cbe12a576520802f2b4a941ca7e07c2e8f439adf5823154903b01539e6646606fae18647948bc05f521d55214e5f36c0a7e5ebb9a8cdbeb1b1d4b5a23c505b7af6d73e3da14ea953b22124f5c73c62a3e66967340b0985d662fbc3fa35bffd13bd508b111854d3fb5ac9602d4a2fdca89c842f2ec672ba51507ffc72993daac3bfa97023611e2932afe652ab336531434be74b9368b449a631c6e0dd796810cf7b207696f9bb8162ffee3855fc30d0e0b4642c278fbab6725f408e77d2b336ff0da9011af5b9a55371e9d8205a6509497c3cdd0d7b9e61ae7b0e2be5cea8d58fbdf75c4fc83b3918aa83e8c6c1265e573a4ef0e544e5e652a56eebb454b8220e690aceb99e218b58ee823abbe2cb18c39707f5f9f62434486fe6de44d7f26bebbbaa13cbc933464758811fadd5d89dd3435ffa81b55b5b731d8d62782891b135537d34d904111814ac56322ab1817a403e07798f322e0671c166460c07f460d9cfbc552e7981407ebca1bef7f17a6b5e3554c71d380ea3c7e4e196f9b258b55c8b5677a01ac2f3f93c30cce0d26b8820d31e9e65769a15575cd0a615318f3818453c0aaae38a5eea19ce113d49042cac462ff1c50305cb1f2d5233f47d454fdc69cbd4dd6f4a979bf2ffe1177422837500b774bc7f40e0c30ac25289228268f5dcabc205aab2c0bb676233be7bd011d9b77d2ce9b665bacb56bc39e527ab4896659b1ab8b6654a932ed6684757eddc9b659d8aad229d4f452e56a261f87c475684d9a032ef2d38c80b97ef5c648c0165d6bdffee3ce05573ea076a7cb7eb92c63b760fceef4ca0041d3ca361df2e62eb49dcec731ff3fe2e5000d5476495d32d7e6abf82e22019d97c6c6ee5b6e4bee3ad3a2261bdbbf9bfad16a581489621fb689bbee3eee3878b5ad5af9ee4c28159c82d927ec9de02ceeef00b8f16a1f957274cad76d6831a9f497c95039579c55bfcc91404496e38d2cdf7c4ea5f666f7e3fdb1fcbd1593755d9ac537e75a4c7d8d9212a888bf0737975912c5bfdeb50c068a7f8f0e339ae0316238eeb664152e1974dbc63e6563c29aae6e9be9e1ba1b3ae70f41d6e05757226c7079618dece899df326a93bd1878f2f833699d8855b933adb856aa8ef83fc59424ffa3f40000000a70615f593aae9925f1785d7e74f43ed5eb103bfcb651d2beb1d24134001deaa1e33ae6df4b12c57abc3402b1287bdf68bbb77043bd1f773041b243254aac0eb svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400662570833 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000001f0b20806e84845db602d9b1d5f092efdd1b0728d231ab00eae7dbf3f7c182d7000000000e80000000020000200000007bb86a0980f703c7c4a9fb4871ca8cdb068e5213fecc1f84587803e483ec9042800000006a603ceb52db632f6c564527f6a441dfcacedd42e7d9b9783aa27b10d97875a3b0e3ec242d578361769bd852b2ded07ba8411197413902f9841cc1e94050a50077f2adc12754349db68b82e095b3350dcdcbed69550c5b648b6346dc4763303d290ff73d1f360b62a400c7f454214a0679e800ae5dbf3839fcfac9566fc61ee2400000002af8defb4fe4796d4921fef43775992d0b696503c2103cb4a36f5737f33f0166383e7c202e6a8612e59a8a3c3e0f48691fd48188ddfcdefe9be73300e02ab087 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000005d2ab64129f5db97efdfc57b25a443af8eaa0e5d4588feb3227f8f3663564a56000000000e80000000020000200000007b1cf31f16967bf86550b3f09b542ddbb1945f9c9f542b51a1d8b72a3839f2c6100d0000ff31fec51875b1fc3db7408632e688276bb4194e1ab904e83a362fdfbc92cba509db06a15ca1451d2ee8f3004b3042e8f7135a689e77fc8467d2eeb4785beaca7d0cc40ce250eeeb3110df1700a724806c056b6c87cf6683b565ebd273613cb00785fb40417be5047400fd21d79fabdfb604a0d1af2d841c6543bb7e388383f09b929ac34fc321ce923a99a7bc99779d1949405bfd29c074a19632da23c4698fc4ce54e584e41ea5ebba8719b4cb29a27b3139b886b04e1f8ac05f6e01288e90c7bdb477bc074718927372803f200980d56491724ca3c08c063c054f1a29577fddc1ac72008dde081c8831f434ec026bd9860aa500a4e54c4986799ac86e5019402f839357985923448438057cc78f9bfd7ed9ff296d0a74c10caa0b4c29d0b037e0d45cb085facc6fcbdcd677ee45978c9469c8f40a7f0aac006b3a66b28f7a6fc9cc9ba3996789e20b6464c23a56963833d38ce13645346dfc84146e6880534c3a9e48921ff0db0afd42f7813c7a963bf2fe32b8e9e16e8f9bc3336ef07d359f5d3270460bf07d478c928d42ee5952feeeefe130f363ac7789f0472c727af64df2edf27bd4e2b59f05d28283252fa815a5786b7850121950f5fc687ec45b8ea10de708aae6fed891cd17c517ce9390ebb843e3a8a7e4c18c3bb3d2a7d124dcd391cebdc50b6a612dccc5aec52d3a3647be8444e17d54f30fd5e979027bcdd6a8579f406a49d18180a55413c615271f6b1160a0eb7089ad82b0cd7786e9b47c5ea156dbace2e2cfacde92165876512bc11a103b5c49e6cbca4baf3ae4029550e46a5232e39b44d9e64e21a840fc0aa379f0bbfe301812a394eae2c151e09888038d2328f80397f8bbec7db07da4da3d1da2013727a2b896f3b3e6478cd89b97c2814c18d7ea102e2bcbfdb61b59b7fadae8aa46cd58361f2182b73f1041e48d1c1072c37742d6c0d8c09180e434138776ad6070bbdc61fe24bcbd4c761bb126cf3173e1f7d3af6b9c2b98fe2ec933c2ac0b884f7db79633e80a63d3aaacb1f3f1c79c565a809269a5915ab713d230023f2dc03762a15fe6e43c224a5b8c04fba73118e8bf62412e9880238abb773666a0e5a7e9142506ebf93ea6eebef9602257424d66be953a033189527c2502e64467001ca664725a7908346d71ab8c6c38ca7d8e2d4959c54bf253d019156541cc91c695ac476095f102b99b2cca9f6fc79ec01f969640ec70d09bbef9b0b0e4059b9f8e923cb0f556b4ba95660c46bea4aa16501142b1ad9cd4704e2fc054363669847f16746f0496be3ddf09349ccde9139338a8aa3833fc6b04115ea6d3e3b493df7dcc6eab847b9a3bdd0ba8dce72f65bba9b5507ca2335afcc3e8cba4c0e9a8294b2d470d88e49cb0989772643528a8e05d4b89ee8a5671cf781f9798245845df883257a013ee0dc70c825a53f4c1acc7a5453fd829263c265931ab3af7d46474f967f29a4af525d95c36004d507843aa5a8c2f5c197769c114bcfaa58d82729fe16f624cc36b1368131b0a20271494652691910d70af81b405a1cd2f7f73b9f6d4278b7e37372d15fa9b8f71cf8216bedc7734c732216bc6ca73efeadc67fb5b0b87d8a2ec68bd0324c8a318d4445d6ddc7d4353f3646c4a42b95b94c20de605de8b57e9b0ca1e7cc90237c0b43388cc6b7a11159b2b373bfe56633273cf85e570929eb0f2d72a570c390c7ade3e4dabaab1536245e508c2be49be414002a9777a65464d02f20ed94d78def37db93dae6a68a1f22cc2c6e6b7445b29b240140913fc0716dbdc252a69c367da872402cbeeece9d63956fb36f39f4cffb5f09058131340377ecb8a1fa663b7e1ab0af50b808e8683e638a5aba965c71ef19649cec53c7e06986926096991c120f21a3e7276daef9080122daedb606f166bb1e853ed36e462c23f25a43f264221005fc9fe7cb15c8781ce6d98e7529e00a10db65de6561496cee13b7cd817a027bf715f936a8b4aa599f9410c0cb6fca46ccf388014dae01f575e8b91961fbeb7e9e24917bfe7a5d6c6fa599fcc0189360db6c19370739043d2a6fe43dc0654299659c52acaad896266b3fecbc0b6b9f2666b7768edb41dc5f6f1cee424e22172b0205146aadcd0fb5d01b51f3d83334dc8f7e0591794542767aaed7a85bede0b7643bc69381d1b0bd8d1197ba9ccb46076bfbf67a25315377281ada30804c7e543bfa7e11f169f60783f7816d0fa3038c67672fd880b9b323495a5ef2513b1a71a455959420502c058be40e45717059d0c8b2582cc728b6677919a5adc3d6af85266e4dc37535d9a250b4b17d5d3484dddff62530f5d7229cb32317095e105601fee1d637b1713170f27761569860d0bae12eff47a7d3739bc673c429fcfcbbe66b91a8406f57e88293b60974586827a11d9a1194a1021270a0148e01fe128195188f76151c70e9f8d045293c49aea72befa3fd18fea54bedd91119414656b8c635e68308f326806455a9d21d108dfd3d804f9c2794517f3da3769a202acd835f5707d26a883bd829c9d29721cd3749a48178727e8afd0bee3eeaf611075c09b9c6b7edcfd269fa18d827ec66731cf2625fc16348d49038b42f7a2c950f32fba9312cd2b44abf0b3d2a6dbc90a65f6a00829206abc62a907482322ff91eebcdde2894a12db0f22e17612713f9952748fce77db62ae9ddbc5c2b719b13bce76b0a21671eda8374464ad15ee8d2dc434beb18a8f995156e48352f483e81906397d44cae29502fac4048ebe6674492594556f9393788d373f23334bfbcaf71cd4c1dfcb4f2897adc3db4adcac898acb5a00252633cfacaf6873001c76318d909e6179846ff0cafe08b82ba5ad9efb0cb9bc7b5f0c546d8945fb90c5d5ca4fd627852b7ca5066113e2ad161c0968c79c7acc0780bd991cf04a8b80b68c3d42ddc1f5cf737368319d0c49a497d35e7fa68b6c4535e15d3760d116ea7dfe937d09472d63d72ccab62c30f592577a29aa077845a00d26103b03ad613f8d11ab95f353a0be6f5d6098f8b807fede09ec1ca9203ab40f0dde0279a30022ea51442319365b4e3e5ded003f4d09ec5c06e14dc49149b85fed8ca39ac5f1e20f6f84763e858ead974bc4370e834db7c39839d65791a401a38b2fa8376ea27a049f8f9fd198849a4959851c04b61a9279f67e0d6d2b5209f6ce19041da54623041f18e3f11434fd0f661b07ddff483d5152bd7c5d29d9c34a260e347298ba3c456580b77d2e699671522589329bfddf2c768d93e0e8e150d718ebb78bb0f2dea670d6bab7cc9a029dd148ea57764b9facd057f712788b465d436e4104db7084c86076ddcc8066704d7e5c3838a5fb5840ec196b45402444979a26dafd400a1656238ec6226e4866c8c22f0a4d4ed6f5ea82ae1aa1e15a7ea791d53351585065f06ed3ceeb3886ca9699bb4f4149ee37296ff6e6d806de675aaae9351af36fbe66528f1d95ed6537dae8ca4251faf2df6c4ee2a7cf5ce140a82938aa8b52b7c55ceed203efeeef730025bdd4a5f0bcffe7ee5d6a1b2809e61160cc72715d7d0ed535cad675ea332a4212f1eadc5a9563211e49835081c3cf95dce8dc81947983a843fccdac7026b29afe5706cbac49e3040342bce807aafd001cd54600ff4550c6bbe787ae3a150a82151a111c1b890a634e10f235795bbde15ff753e2fbac3bdeb7d83939c1fc64e72b2ce6dd565c4002e543d0dcd158310caa4de9428ebf7280bec4666fc3f462c61a95dddb0c8770de76c9237fc86b9391d934c72c497d808d490a083a5b9c362a46cc5f74a7bd011edf01c867b5b340a6b1c363709658f24d86c11cb93106d8159e25d2af5e0a3359e6aa040c399977a3c7d6c52e412d7b9971b05d3258f896bdc515e37683e7732bfeb68b914e86f801f83734266fe8aa228798744b4eee9632465248d3e7468aacc37c4b47e4b8fded3ceaa86758ced286ae2ccc16a602939b27d6893224ea1e8bc69cc27938c2ad9ef9f0b75c7340a1fb5a7d15fb5b1d577889ef75e4c280a1e0f7b0bdc4911377706f97a252faacbaa9c008ef57f87d035bc887ef2e377550415aa1e406057e760ce911336abc09758a834bb5b7569b80a1342e9f99f04f0379b8324667529ef519e5f4fef87602f3afaeee8adae71904e72aa541fa7bd63d78e8dc4c969aef19ed6e2e30e4a285580d0558b5a5aa653eed8a3f9a08bb9c67b849cd749331e1742b4046b53c13ed24f8a6f3b7ca97e26a787ae14cee34e315dfeb39feb0f39dc5945d1931cff8029e004125b5b00363527995ec0aba75300f2f33bf0382d99d516bf8d69e37db7530bab392927c46991fbc03f6c131c629235312d5c051664d601a3f85b931ce9ee7128e01e6f195fd20e4e8ad79a0724a43489e0d4cf1a220dba9a6dbe174e087cc51a9cac4bc6a47991ee921a44c05456e4ce6d2a37b07d3449f0a4b7b360ff7532ad2dc9d5610ed016b9cdf1207697b2089a61b2da5870bf8c019e3a6530653985a5a72a6013e273e59fd7c1a008e50a8b4e1be005ef56782f98b5950ec4aad2c890f5bedf02c0f52e4802f8ba1aafe7d56464533505e6176f39879d920f3ab70cb8a9ea8a96b45af90898ac949ebd58fe6dc50aec27262320a64e8642460f14469128a4c3f12046bbe74848904b75ed17e4c5c81bb05d596e31fe364a20d693bcfcd4c6b4eef90014544b336de531dd1d5f859efabfffa364b400000000431a5a93953ee7bbfeff34a545ce8a36a75fa5b094c925489103a9a94dabe0ebf6acb1a2529894b43b6c188e3871111c20cb2c6d3039da5e8f4c5974e5299fd svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400662570833 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000052af5758cf38939f85f552160735df38cea8e0f0aa3ad65d16c0e1a4a9a103b0000000000e8000000002000020000000557c728a6b84246321526fbb09f4667a3fed3df12a6cf5725ef3adf60960eeaf8000000029f04584b1e65fc3f661ebb6a35a8cf8f7bae2ad24b15017ed2159189be435e5ae1edae14ebd5f9c47d401c48e1b892a7133d8fa1432c1aeacc0f4a0dca92d7c77360be05f84d2051d8fdbc0f5977492541fce8a72c69883df9d8bb80fef146b5e2f172d667b98dc8d5338244f17f44f1e547b3a306cc3c33911a760ea667cfe4000000035c6bfd6de5614a4f0b58a1e01471a4893cc4cf07efb90505442f30a5ad7cc0bb9ca7e8a45d09eaa52662f07aafd69f8b0836872bf4681ef55186522c10e3167 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400662570833 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000edad65b7c3b674632b5d4d306cfe5c4e28de4d3ab2f37cc1d45c98b6e7793bc1000000000e8000000002000020000000c6e26a0da4de04bf6abe0a0984abed484a4c20c1263b7b08d6555ad239fc8b588000000075d6a9390bd0451e7423711f7cbb89ba597f404472172ec1a895e610960fe23b8c8738f9ee9a14c8b267b38dbf21eedec9a348c1d156c6eb914ae15efc66d20f1176d7abe32dfd4bc83f04707fd9ee44ca01f625a3ac7824f6135e9ddadf0628536a2f69abfa9c8bd4ec54978f3192d1bbd3a71056e146f7927aca893ab2ec3240000000b3a4e142b424b1f9283537264fd6df8cd738a620ee11919c03156d6c6ecb8caf182d5c0a19002cdf088798a4959fe6d2b0b460eebdb1e6a034fb906b84cb86f4 svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 400 regsvr32.exe 400 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1012 wrote to memory of 400 1012 regsvr32.exe 82 PID 1012 wrote to memory of 400 1012 regsvr32.exe 82 PID 1012 wrote to memory of 400 1012 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\86587a8aa1e46d2f5cdccfc0a2b7147d69c680d62f65a464acb3a4297acd15bc.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\86587a8aa1e46d2f5cdccfc0a2b7147d69c680d62f65a464acb3a4297acd15bc.dll2⤵
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:4308
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:1096