Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230831-en
General
-
Target
client.exe
-
Size
295KB
-
MD5
b54e56a2503ac379bcd8e61852d5e861
-
SHA1
abcfaff56afa6239ac8efaf8e36ef22b6cc9e8d9
-
SHA256
d5c77653349176a796c3846dfc596292563d0588564eabf542c978b61597278a
-
SHA512
fa22a6d5369dd5a06647752ea9ec9f335fe57682931b6808bcd4dd84a3eac5d33f0ec525e23f893b820c6b0e76f46c53ae3cf14ecfbf4e468730dcff817a6513
-
SSDEEP
3072:w6JyBmvmBEayo1tFHtWl0VnkDS7cW6VnYR4UhsyT+dNIY:xJyIv4EayofFNVtMns4y7T+r
Malware Config
Extracted
gozi
Extracted
gozi
5050
185.247.184.139
62.72.33.155
incontroler.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
expirew.com
whofos.com
onlinepoints.online
onlinepoints.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 4796 set thread context of 3084 4796 powershell.exe 19 PID 3084 set thread context of 3780 3084 Explorer.EXE 20 PID 3084 set thread context of 4008 3084 Explorer.EXE 45 PID 3084 set thread context of 4768 3084 Explorer.EXE 34 PID 3084 set thread context of 3108 3084 Explorer.EXE 85 PID 3084 set thread context of 4968 3084 Explorer.EXE 106 PID 3084 set thread context of 1264 3084 Explorer.EXE 108 PID 4968 set thread context of 1420 4968 cmd.exe 110 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4504 3596 WerFault.exe 84 -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\06bf94a7-51ee-434b-9 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000d42cbce2f8f5d9010292dde2f8f5d9010292dde2f8f5d901cfaa06000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357ee662000373232346361356361613133303531386333626238633136366263356330316164366137363361313662343563653734643136663766353437346335303931310000b20009000400efbe4357ee664357ee662e00000000000000000000000000000000000000000000000000d7081200370032003200340063006100350063006100610031003300300035003100380063003300620062003800630031003600360062006300350063003000310061006400360061003700360033006100310036006200340035006300650037003400640031003600660037006600350034003700340063003500300039003100310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ed69730e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37323234636135636161313330353138633362623863313636626335633031616436613736336131366234356365373464313666376635343734633530393131000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8a6c23931f9653ee11941eca4df275542e52d8063eedfcdf448a23f9f8aed1bb8a6c23931f9653ee11941eca4df275542ece000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d42eed0-e2e5-4756-8 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d42eed0-e2e5-4756-8 = 38a324e2f8f5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\425c470d-4565-4332-8 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b7997b5-efbe-4774-b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d420d1d8-d520-433c-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d430aa5-e18a-4cd6-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\2eb7548f56f99c6172427d6fd2db39c3682207e7a94c0b484e859f599e153025" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef75c190-6428-4515-8 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4bd6e030-e6f0-4acd-b = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d430aa5-e18a-4cd6-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef75c190-6428-4515-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\69f1a8ab-e1ed-450c-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d42eed0-e2e5-4756-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\06bf94a7-51ee-434b-9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\06bf94a7-51ee-434b-9 = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d42eed0-e2e5-4756-8 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d42eed0-e2e5-4756-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\2eb7548f56f99c6172427d6fd2db39c3682207e7a94c0b484e859f599e153025" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef75c190-6428-4515-8 = afc45ae3f8f5d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\69f1a8ab-e1ed-450c-8 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d420d1d8-d520-433c-9 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d420d1d8-d520-433c-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000003de231e2f8f5d9013de231e2f8f5d9013de231e2f8f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357ee662000643631353765356632666238623037646562633563303561323663663739326234626638373338653163396632646334646239373530333136333665386533370000b20009000400efbe4357ee664357ee662e00000000000000000000000000000000000000000000000000c3bd0300640036003100350037006500350066003200660062003800620030003700640065006200630035006300300035006100320036006300660037003900320062003400620066003800370033003800650031006300390066003200640063003400640062003900370035003000330031003600330036006500380065003300370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ed69730e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64363135376535663266623862303764656263356330356132366366373932623462663837333865316339663264633464623937353033313633366538653337000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8a6623931f9653ee11941eca4df275542e52d8063eedfcdf448a23f9f8aed1bb8a6623931f9653ee11941eca4df275542ece000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d430aa5-e18a-4cd6-8 = fabdf7e2f8f5d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d420d1d8-d520-433c-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4bd6e030-e6f0-4acd-b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8ae1b00f-3e09-4516-8 = 532041e2f8f5d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4bd6e030-e6f0-4acd-b RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8ae1b00f-3e09-4516-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4bd6e030-e6f0-4acd-b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ab14ac0-86cf-425d-b = 85c532e2f8f5d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d430aa5-e18a-4cd6-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ac3caf4-e181-439b-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\425c470d-4565-4332-8 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\425c470d-4565-4332-8 = e56687e3f8f5d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d420d1d8-d520-433c-9 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ab14ac0-86cf-425d-b = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000061bc2ae2f8f5d90161bc2ae2f8f5d90161bc2ae2f8f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357ee662000373462643736323135346266613262653561623633613633396661323738663763363236353530323064343162326366363564303030376664346236386231360000b20009000400efbe4357ee664357ee662e000000000000000000000000000000000000000000000000009fe30a00370034006200640037003600320031003500340062006600610032006200650035006100620036003300610036003300390066006100320037003800660037006300360032003600350035003000320030006400340031006200320063006600360035006400300030003000370066006400340062003600380062003100360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ed69730e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37346264373632313534626661326265356162363361363339666132373866376336323635353032306434316232636636356430303037666434623638623136000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8a6523931f9653ee11941eca4df275542e52d8063eedfcdf448a23f9f8aed1bb8a6523931f9653ee11941eca4df275542ece000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8ae1b00f-3e09-4516-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e79ef4792bd488a6bf852cec1ae765edbe4c3f7fc2aba9d8516890ec6f0b3798" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ac3caf4-e181-439b-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000007ab787e2f8f5d9013c6ab7e2f8f5d9013c6ab7e2f8f5d901b87d08000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357ee662000643631353765356632666238623037646562633563303561323663663739326234626638373338653163396632646334646239373530333136333665386533370000b20009000400efbe4357ee664357ee662e00000000000000000000000000000000000000000000000000c3bd0300640036003100350037006500350066003200660062003800620030003700640065006200630035006300300035006100320036006300660037003900320062003400620066003800370033003800650031006300390066003200640063003400640062003900370035003000330031003600330036006500380065003300370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ed69730e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64363135376535663266623862303764656263356330356132366366373932623462663837333865316339663264633464623937353033313633366538653337000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8a6a23931f9653ee11941eca4df275542e52d8063eedfcdf448a23f9f8aed1bb8a6a23931f9653ee11941eca4df275542ece000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\425c470d-4565-4332-8 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\52d62ebb-b6be-4308-b = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\8d91a7d611390e41c0ec45dd2f1e5b06f3b71bfcfb0eebb920ddb0d8860ba85c" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\06bf94a7-51ee-434b-9 = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eed89e20-60e1-430c-a RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d42eed0-e2e5-4756-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ab14ac0-86cf-425d-b = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ac3caf4-e181-439b-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ab14ac0-86cf-425d-b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d420d1d8-d520-433c-9 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d430aa5-e18a-4cd6-8 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a11d6be2f8f5d90182e3ade2f8f5d90182e3ade2f8f5d90128b202000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357ee662000326562373534386635366639396336313732343237643666643264623339633336383232303765376139346330623438346538353966353939653135333032350000b20009000400efbe4357ee664357ee662e000000000000000000000000000000000000000000000000000c6d1400320065006200370035003400380066003500360066003900390063003600310037003200340032003700640036006600640032006400620033003900630033003600380032003200300037006500370061003900340063003000620034003800340065003800350039006600350039003900650031003500330030003200350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ed69730e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32656237353438663536663939633631373234323764366664326462333963333638323230376537613934633062343834653835396635393965313533303235000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8a6923931f9653ee11941eca4df275542e52d8063eedfcdf448a23f9f8aed1bb8a6923931f9653ee11941eca4df275542ece000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef75c190-6428-4515-8 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef75c190-6428-4515-8 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\69f1a8ab-e1ed-450c-8 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4bd6e030-e6f0-4acd-b = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000299723e2f8f5d901299723e2f8f5d901299723e2f8f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357ee662000373232346361356361613133303531386333626238633136366263356330316164366137363361313662343563653734643136663766353437346335303931310000b20009000400efbe4357ee664357ee662e00000000000000000000000000000000000000000000000000d7081200370032003200340063006100350063006100610031003300300035003100380063003300620062003800630031003600360062006300350063003000310061006400360061003700360033006100310036006200340035006300650037003400640031003600660037006600350034003700340063003500300039003100310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ed69730e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37323234636135636161313330353138633362623863313636626335633031616436613736336131366234356365373464313666376635343734633530393131000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8a6423931f9653ee11941eca4df275542e52d8063eedfcdf448a23f9f8aed1bb8a6423931f9653ee11941eca4df275542ece000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d430aa5-e18a-4cd6-8 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\52d62ebb-b6be-4308-b RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ab14ac0-86cf-425d-b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\69f1a8ab-e1ed-450c-8 = f3101ee2f8f5d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4bd6e030-e6f0-4acd-b = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ab14ac0-86cf-425d-b = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\52d62ebb-b6be-4308-b = bbc62fe3f8f5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\06bf94a7-51ee-434b-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef75c190-6428-4515-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\74bd762154bfa2be5ab63a639fa278f7c62655020d41b2cf65d0007fd4b68b16" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4bd6e030-e6f0-4acd-b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2ac3caf4-e181-439b-9 = c88c19e3f8f5d901 RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1420 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1420 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3596 client.exe 3596 client.exe 4796 powershell.exe 4796 powershell.exe 4796 powershell.exe 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3084 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4796 powershell.exe 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 3084 Explorer.EXE 4968 cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 4796 powershell.exe Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3780 RuntimeBroker.exe Token: SeShutdownPrivilege 3780 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3084 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3084 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4796 2808 mshta.exe 100 PID 2808 wrote to memory of 4796 2808 mshta.exe 100 PID 4796 wrote to memory of 4932 4796 powershell.exe 102 PID 4796 wrote to memory of 4932 4796 powershell.exe 102 PID 4932 wrote to memory of 3516 4932 csc.exe 103 PID 4932 wrote to memory of 3516 4932 csc.exe 103 PID 4796 wrote to memory of 4876 4796 powershell.exe 104 PID 4796 wrote to memory of 4876 4796 powershell.exe 104 PID 4876 wrote to memory of 2840 4876 csc.exe 105 PID 4876 wrote to memory of 2840 4876 csc.exe 105 PID 4796 wrote to memory of 3084 4796 powershell.exe 19 PID 4796 wrote to memory of 3084 4796 powershell.exe 19 PID 4796 wrote to memory of 3084 4796 powershell.exe 19 PID 4796 wrote to memory of 3084 4796 powershell.exe 19 PID 3084 wrote to memory of 3780 3084 Explorer.EXE 20 PID 3084 wrote to memory of 3780 3084 Explorer.EXE 20 PID 3084 wrote to memory of 3780 3084 Explorer.EXE 20 PID 3084 wrote to memory of 3780 3084 Explorer.EXE 20 PID 3084 wrote to memory of 4008 3084 Explorer.EXE 45 PID 3084 wrote to memory of 4008 3084 Explorer.EXE 45 PID 3084 wrote to memory of 4008 3084 Explorer.EXE 45 PID 3084 wrote to memory of 4008 3084 Explorer.EXE 45 PID 3084 wrote to memory of 4768 3084 Explorer.EXE 34 PID 3084 wrote to memory of 4768 3084 Explorer.EXE 34 PID 3084 wrote to memory of 4768 3084 Explorer.EXE 34 PID 3084 wrote to memory of 4768 3084 Explorer.EXE 34 PID 3084 wrote to memory of 3108 3084 Explorer.EXE 85 PID 3084 wrote to memory of 3108 3084 Explorer.EXE 85 PID 3084 wrote to memory of 3108 3084 Explorer.EXE 85 PID 3084 wrote to memory of 3108 3084 Explorer.EXE 85 PID 3084 wrote to memory of 4968 3084 Explorer.EXE 106 PID 3084 wrote to memory of 4968 3084 Explorer.EXE 106 PID 3084 wrote to memory of 4968 3084 Explorer.EXE 106 PID 3084 wrote to memory of 1264 3084 Explorer.EXE 108 PID 3084 wrote to memory of 1264 3084 Explorer.EXE 108 PID 3084 wrote to memory of 1264 3084 Explorer.EXE 108 PID 3084 wrote to memory of 1264 3084 Explorer.EXE 108 PID 3084 wrote to memory of 4968 3084 Explorer.EXE 106 PID 3084 wrote to memory of 4968 3084 Explorer.EXE 106 PID 4968 wrote to memory of 1420 4968 cmd.exe 110 PID 4968 wrote to memory of 1420 4968 cmd.exe 110 PID 4968 wrote to memory of 1420 4968 cmd.exe 110 PID 3084 wrote to memory of 1264 3084 Explorer.EXE 108 PID 3084 wrote to memory of 1264 3084 Explorer.EXE 108 PID 4968 wrote to memory of 1420 4968 cmd.exe 110 PID 4968 wrote to memory of 1420 4968 cmd.exe 110
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 13923⤵
- Program crash
PID:4504
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Tkdp='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Tkdp).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\2B8EB0FA-8E4D-9577-F08F-A2992433F6DD\\\LinkActive'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name kkddinybv -value gp; new-alias -name vafomukax -value iex; vafomukax ([System.Text.Encoding]::ASCII.GetString((kkddinybv "HKCU:Software\AppDataLow\Software\Microsoft\2B8EB0FA-8E4D-9577-F08F-A2992433F6DD").PlayPlay))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zgfh5x4f\zgfh5x4f.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FAB.tmp" "c:\Users\Admin\AppData\Local\Temp\zgfh5x4f\CSC431D0170320F4F839199EFEF36271CA.TMP"5⤵PID:3516
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\by4dkvz3\by4dkvz3.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8085.tmp" "c:\Users\Admin\AppData\Local\Temp\by4dkvz3\CSC9AB98441A22F4868BCFDA0C9F155EBA5.TMP"5⤵PID:2840
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1420
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:1264
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4768
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4008
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:3108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3596 -ip 35961⤵PID:1652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5006f9766ac473fb482c401a929414857
SHA10357908e5911409b3aabedd0ce9515603148284f
SHA25673030f96a02aeab11dccd58497d1ce4dc80c42542102565ac61450bfb923206a
SHA5127f57d8159354efc81ab96fd92ffe18fcdbe1b60a04d8c9615ab5b9344baf555aa510702834c16f48642980596ceb8000697ce9e231428fac2f48942dc92a249b
-
Filesize
1KB
MD51b63818ff1232750ef2a91dfe14fab41
SHA14a29ffbf5e54027948d09e5c140f27c410417955
SHA25638f803cd2180b02f4326450003eaa22261b80c48ee7d84678187660f7b76f51b
SHA512beea09d1ee811de83624cbb96d3630a1cada7a570e3a037894f2a88a2a6d57890445794b3ef5ddc796251e1fced4968cae0f447204d3e631cbe0c8fd253803c9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD520bf82815ca2842993a808db18d2886d
SHA13ef565e68186b230df5f0994b33d56a442a03bde
SHA2560cf45f0aaa93e9c0a5eaec4aec2545e5cae72feaf7a8ba82c53a91ffb785d80a
SHA512f6adb29428a5ff8b321428610ef3f27434bdf3cb30239a41b3beb94aa142bd5f1e8fe641bacbc0983cf7766fa775f3d4171b81f7de6de210008413c61b8643f7
-
Filesize
3KB
MD5fa7f399c7df57259623e25c09aa99390
SHA13ad072a4eb0675dcd3e7166dbfae56263a50414b
SHA256f233a4478d421614ae85f9a8a5c0c3f7ace4c3174d279746b6387b691928be13
SHA5121746c572271733321447c86a334125bfe2caa8519933a1d9f8c18369d50a6ed1a1ee1b9d5a20d84dd5f6ea04cfb9ca37441d232c21d700e7e856e019d09cd4c1
-
Filesize
652B
MD534c4c1134d9e4e1a34f532469b364af1
SHA1095001f9c500c6b6478d5f0974c618c8ba881ff9
SHA256e1eb21505ddee08fd89df387f2f857a4323fd17d0252d7cc65d3095e75c61483
SHA512e260640ba2c041c26001444205f7cf0e543e90a5ea153f93ece1c8513f14dac249281130a7634535003db51696edf7d568bd9c69144586ec346f2241a2c4306a
-
Filesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
Filesize
369B
MD5f7dfe5e4c7e452d9911639b880a7e13c
SHA16940a48bfd24f7e5d8cb26dd9e41c28fc79ef1ed
SHA2569e696693700192339d9bbd02782aa372675606e0f8804ed8c2f6fe144c6dad9f
SHA512de6ccc39780bfb88626c83ec5e24ce36a65e18ebffd77e7865fa4780ce22d9b9bcab9d315b00e088f56473d73d1eab4ab62d41f6a7b707c13ffe69f85a4c00be
-
Filesize
652B
MD5c95447a448c7b4a6f3d0213a0ecca27b
SHA1c7a26ea2ce8eccdb4d6df57305b7644dfa760560
SHA256ce366a1a043a36026351e4b2f85b3beb0bc8515dbc359f3817abebe8656785d6
SHA512770d29e05163eaf31fde2e6902841ce93c85c5b4ec3430a00606de3010e49aa904429338f2f3b9341f579f378ec6105f2350ca97015b497fa7a4a0e6d39f0e2f
-
Filesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
Filesize
369B
MD5d97a3b7be33ce1f6e8ff837772bb6b4c
SHA1e9d00387ae20702c9cd26a97d81b61677ed00243
SHA25663d42cd15ae27feb402318c06b58e3bca15f218e7aa6e324dfcac7fc81d5f6a8
SHA512166dc80b3608cb098b8649c01af1a2cb0c9bf012c04d87e3efc63bd3154e63e8cb751603f7c85796f7f74fcba3b5a97e088f0f791beed640b00f28ec48c889f9