tinba | 77ddf9ec362d3aea823f397427cfed8edfaa9eb7be119a49f4fd41d8bd7eb129

Analysis

max time kernel
162s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 05:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48303f1ea4e3ef6a73c9e5b2687bccb4.exe
Size 160KB
Sample240107-gf3bksfdbl
SHA256 77ddf9ec362d3aea823f397427cfed8edfaa9eb7be119a49f4fd41d8bd7eb129
MD5 48303f1ea4e3ef6a73c9e5b2687bccb4
SHA1 ff3e014db73a6aa243973df4bac6e605eb3b35d9
SHA512 44262595d2aed442c224f0afb4709e7c56d0fc29343dead33af3d59a22a1a7fc4633ad26f16d6972e467cc266a7859f3c7ca383baa30f8855cf88af958a44357
SSDEEP 1536:vEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:cY+4MiIkLZJNAQ9J6v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1140-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A2BFC71C = "C:\\Users\\Admin\\AppData\\Roaming\\A2BFC71C\\bin.exe"	winver.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	backgroundTaskHost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	backgroundTaskHost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15- = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	backgroundTaskHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456- = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a- = 556dc31e2d41da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f- = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002343a91e2d41da012343a91e2d41da012343a91e2d41da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000027580b2e2000323135626435633032303166353937323461646331646437383362393261626465376635636464303564666563306636363666376536313231396636663363360000b20009000400efbe27580b2e27580b2e2e00000000000000000000000000000000000000000000000000dd13eb00320031003500620064003500630030003200300031006600350039003700320034006100640063003100640064003700380033006200390032006100620064006500370066003500630064006400300035006400660065006300300066003600360036006600370065003600310032003100390066003600660033006300360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000005b97eec31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32313562643563303230316635393732346164633164643738336239326162646537663563646430356466656330663636366637653631323139663666336336000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef5bae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef5bae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c31e7be9717e1716e8c6ede550d8340d4e4afa40c1e35c00712222bce7a4bd30"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a- = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a-	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456- = eb98961e2d41da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	backgroundTaskHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15- = dd7cad1f2d41da01	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a-	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002f098f1e2d41da012f098f1e2d41da012f098f1e2d41da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000027580b2e2000663835343832353830323661303732323736633834386233303539303538666563646330373432656539613230653464613364323736646663613832633637320000b20009000400efbe27580b2e27580b2e2e00000000000000000000000000000000000000000000000000d14d0501660038003500340038003200350038003000320036006100300037003200320037003600630038003400380062003300300035003900300035003800660065006300640063003000370034003200650065003900610032003000650034006400610033006400320037003600640066006300610038003200630036003700320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000005b97eec31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66383534383235383032366130373232373663383438623330353930353866656364633037343265653961323065346461336432373664666361383263363732000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef5aae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef5aae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15- = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\816d1798d4b64c9655594a0d9727e662b853de5fed89bfe3d97318b263496a02"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000037a570202d41da0137a570202d41da0137a570202d41da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000027580c2e2000633638356337366366613138333634316661326436653662303764393537623433343464626235383064626330623336653038336131646566623861663664330000b20009000400efbe27580c2e27580c2e2e00000000000000000000000000000000000000000000000000c9de5400630036003800350063003700360063006600610031003800330036003400310066006100320064003600650036006200300037006400390035003700620034003300340034006400620062003500380030006400620063003000620033003600650030003800330061003100640065006600620038006100660036006400330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000005b97eec31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63363835633736636661313833363431666132643665366230376439353762343334346462623538306462633062333665303833613164656662386166366433000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef63ae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef63ae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	backgroundTaskHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f- = e8cb7c202d41da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\215bd5c0201f59724adc1dd783b92abde7f5cdd05dfec0f666f7e61219f6f3c6"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a- = 8ee5d01e2d41da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000070a3ca1e2d41da0170a3ca1e2d41da0170a3ca1e2d41da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000027580b2e2000383136643137393864346236346339363535353934613064393732376536363262383533646535666564383962666533643937333138623236333439366130320000b20009000400efbe27580b2e27580b2e2e0000000000000000000000000000000000000000000000000090b3c900380031003600640031003700390038006400340062003600340063003900360035003500350039003400610030006400390037003200370065003600360032006200380035003300640065003500660065006400380039006200660065003300640039003700330031003800620032003600330034003900360061003000320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000005b97eec31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38313664313739386434623634633936353535393461306439373237653636326238353364653566656438396266653364393733313862323633343936613032000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef5fae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef5fae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c685c76cfa183641fa2d6e6b07d957b4344dbb580dbc0b36e083a1defb8af6d3"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1- = 57adb31e2d41da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\063e5812-c928-42e1-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000bc2db51e2d41da01bc2db51e2d41da01bc2db51e2d41da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000027580b2e2000633331653762653937313765313731366538633665646535353064383334306434653461666134306331653335633030373132323232626365376134626433300000b20009000400efbe27580b2e27580b2e2e000000000000000000000000000000000000000000000000004429df00630033003100650037006200650039003700310037006500310037003100360065003800630036006500640065003500350030006400380033003400300064003400650034006100660061003400300063003100650033003500630030003000370031003200320032003200620063006500370061003400620064003300300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000005b97eec31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63333165376265393731376531373136653863366564653535306438333430643465346166613430633165333563303037313232323262636537613462643330000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef5dae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef5dae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a- = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\00fa2fec54fb1ee7993c26bea4f47e9633257cc7b2b55ba1f8cba89200898c02"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b8caaa0-7909-453a- = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0193664-52d5-437f- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e50c16c8-1951-4f4b-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\78dbf027-79bb-4456- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\f8548258026a072276c848b3059058fecdc0742ee9a20e4da3d276dfca82c672"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\13d1e407-9cfe-4e7a- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a472d30-a821-4e15- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000055d39e1f2d41da0155d39e1f2d41da0155d39e1f2d41da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000027580c2e2000303066613266656335346662316565373939336332366265613466343765393633333235376363376232623535626131663863626138393230303839386330320000b20009000400efbe27580c2e27580c2e2e00000000000000000000000000000000000000000000000000abb02601300030006600610032006600650063003500340066006200310065006500370039003900330063003200360062006500610034006600340037006500390036003300330032003500370063006300370062003200620035003500620061003100660038006300620061003800390032003000300038003900380063003000320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000005b97eec31000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30306661326665633534666231656537393933633236626561346634376539363333323537636337623262353562613166386362613839323030383938633032000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef60ae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef60ae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2020	WerFault.exe
2020	WerFault.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe
2132	winver.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeDebugPrivilege	3032	backgroundTaskHost.exe
Token: SeDebugPrivilege	3032	backgroundTaskHost.exe
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3520	Explorer.EXE

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2132	1140	48303f1ea4e3ef6a73c9e5b2687bccb4.exe	92
PID 1140 wrote to memory of 2132	1140	48303f1ea4e3ef6a73c9e5b2687bccb4.exe	92
PID 1140 wrote to memory of 2132	1140	48303f1ea4e3ef6a73c9e5b2687bccb4.exe	92
PID 1140 wrote to memory of 2132	1140	48303f1ea4e3ef6a73c9e5b2687bccb4.exe	92
PID 2132 wrote to memory of 3520	2132	winver.exe	49
PID 2132 wrote to memory of 2472	2132	winver.exe	62
PID 2132 wrote to memory of 2484	2132	winver.exe	61
PID 2132 wrote to memory of 2620	2132	winver.exe	60
PID 2132 wrote to memory of 3520	2132	winver.exe	49
PID 2132 wrote to memory of 3680	2132	winver.exe	48
PID 2132 wrote to memory of 3932	2132	winver.exe	47
PID 2132 wrote to memory of 4028	2132	winver.exe	46
PID 2132 wrote to memory of 952	2132	winver.exe	19
PID 2132 wrote to memory of 3172	2132	winver.exe	45
PID 2132 wrote to memory of 3532	2132	winver.exe	44
PID 2132 wrote to memory of 1880	2132	winver.exe	42
PID 2132 wrote to memory of 4824	2132	winver.exe	32
PID 2132 wrote to memory of 1728	2132	winver.exe	20
PID 2132 wrote to memory of 3400	2132	winver.exe	26
PID 2132 wrote to memory of 820	2132	winver.exe
PID 2132 wrote to memory of 2648	2132	winver.exe	88
PID 2132 wrote to memory of 2020	2132	winver.exe	97
PID 2132 wrote to memory of 1328	2132	winver.exe	98
PID 2132 wrote to memory of 744	2132	winver.exe	102
PID 2132 wrote to memory of 2172	2132	winver.exe	104
PID 2132 wrote to memory of 1908	2132	winver.exe	105
PID 2132 wrote to memory of 1596	2132	winver.exe	109
PID 2132 wrote to memory of 5112	2132	winver.exe	111
PID 2132 wrote to memory of 4008	2132	winver.exe	112
PID 2132 wrote to memory of 3032	2132	winver.exe	118
PID 2132 wrote to memory of 4508	2132	winver.exe	120
PID 2132 wrote to memory of 4820	2132	winver.exe	121
PID 2132 wrote to memory of 2432	2132	winver.exe	122
PID 2132 wrote to memory of 4876	2132	winver.exe	123
PID 2132 wrote to memory of 1196	2132	winver.exe	126
PID 2132 wrote to memory of 1488	2132	winver.exe	127
PID 2132 wrote to memory of 2492	2132	winver.exe	128
PID 2132 wrote to memory of 3776	2132	winver.exe	129
PID 2132 wrote to memory of 4768	2132	winver.exe	131
PID 2132 wrote to memory of 4352	2132	winver.exe	135
PID 2132 wrote to memory of 4904	2132	winver.exe	136
PID 2132 wrote to memory of 4160	2132	winver.exe	137
PID 2132 wrote to memory of 3936	2132	winver.exe	140
PID 2132 wrote to memory of 3652	2132	winver.exe	141
PID 2132 wrote to memory of 3304	2132	winver.exe	142
PID 2132 wrote to memory of 1776	2132	winver.exe	143

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:1728

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3400

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4824

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3532

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3172

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3932 -s 956
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3520
- C:\Users\Admin\AppData\Local\Temp\48303f1ea4e3ef6a73c9e5b2687bccb4.exe
  "C:\Users\Admin\AppData\Local\Temp\48303f1ea4e3ef6a73c9e5b2687bccb4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2132

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2484

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2472

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2648

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1328

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Checks processor information in registry
- Modifies registry class
PID:744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 960
  2⤵
  PID:1596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1908

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:5112

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4008

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4820

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2432
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2432 -s 956
  2⤵
  PID:1196

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4876 -s 836
  2⤵
  PID:1488

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2492 -s 952
  2⤵
  PID:4768

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:4352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4352 -s 964
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3936

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4904 -s 856
  2⤵
  PID:3652

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
- Modifies registry class
PID:4160

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3304

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

063e5812-c928-42e1-82ac-371e9d45a824.down_data

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\063e5812-c928-42e1-82ac-371e9d45a824.down_data
Size 252KB
SHA256 231edb9ff4b49604d4d5b1757c81d53d4b46b1a7aed49c1740598f7ecdad9987
MD5 f66d51c18f95e668e1a279d02925d7f0
SHA1 dfaa3c9732ce43883021972240fbb526b2a2295a
SHA512 b9275d3da3524c1849c7356bc70223258543774944036a879ec8a53d90c49e6284f1b2e4d82bafd8a0cbadac6581f31be4806b0fdaf81de303648d5266c6eebb
SSDEEP 3072:pl6FECg5fxJpkKABP9eC6pGPn4dKKfUV773aunjzzhttHzTDehadg1F+3FA2pOVX:pli+lGP4dZfUtKUj1HDehaKCtpOnd
MD5 SHA1 SHA512 SSDEEP

Submit Download

2a472d30-a821-4e15-b23b-3faea552e276.down_data

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2a472d30-a821-4e15-b23b-3faea552e276.down_data
Size 415KB
SHA256 c98258c35899bdb5e151304f5cccf348e1138720eb4d4d5db7b4791e19e8be2a
MD5 caa40fe3dfebd226b5c47a86b8529d7b
SHA1 6b5f87844ddaa85d07540b090c28aebd65f8b38b
SHA512 481f93d617dcbf7762aaa0768cf5be7042f66adf5e35ddd2063d7f17b39216ece90cbb94be113f1d1d6fa6d671a211407882924c3f14ddd2b25c57e5a31bd68e
SSDEEP 12288:UKzqWpJXVznL48p694tLKleT4N8OmXJ2XXBEq/Z+d:UKj5znMu0leE8OVRy
MD5 SHA1 SHA512 SSDEEP

Submit Download

6b8caaa0-7909-453a-b9c2-3a86181c946d.down_data

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6b8caaa0-7909-453a-b9c2-3a86181c946d.down_data
Size 364KB
SHA256 cbc5bd9ae82617ba1ead4dbb59bf6b11627ab845daf973f99ec34563a639ecfc
MD5 83df9cb3bcdf61e785f92eaa97a4d282
SHA1 53b4c21fa798fd29ce88c0161a0c3402e528fe3a
SHA512 a1597310d438332ea689c3973a3409e3c480a1ac8cb72cfab5a87fb66d08558c1b9dc3f08cbd9540f28e254e72f73113789048d8ecca10d1f4daf8354faaf68f
SSDEEP 6144:j0M7I0BQ0fBniCqQEeXiK6IwZPV57YKjmy/XGaH6lsSqZz57YeKzQ0g7lH6W5HKO:jVxBbfBiCy2iHkKjmyvGaHyqPOvc6eH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

78dbf027-79bb-4456-908a-336ad79cd6af.down_data

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\78dbf027-79bb-4456-908a-336ad79cd6af.down_data
Size 272KB
SHA256 6aff650fd571897cb69a11bf21e3046c83d2ed5579d82468c457816faa749a7c
MD5 9675eb0648ba0d58783f61925006da43
SHA1 5a3d7be177b77e3fc63daaabfb415123e0834435
SHA512 9c6736b1d1de9bfafeeafe9167611eaa77b981b385d7ca99a92dc408b8800f59aefdd893a07cefce44c624a87b58010c90bcdda597775e4c87c89e6c833da328
SSDEEP 6144:3MBe1GCiYZkGMcMTq+i5FW2r8wxHbMd6yLh4TDyHdv9Hm6G6Z7bJ3ZkRD:3MfwkGMq15FdrPmd6yLh4T+V9Hm6G6ZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

1704606494

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280815\1704606494
Size 6KB
SHA256 530c7879200c4c17d049e2bd7be74991963d44feb471a7008b73aa0ad6b723dc
MD5 4f3be920179cf74314d1efed5c57a006
SHA1 1e18f6e98bd850a327b6538dc4d84070c3bf3c3c
SHA512 3634ac11c9d2d768b07afdf75c92ad6d47c849cd9b64fa304bf07a2728ab904a2b92fd4eb545dd7dd719abf6b5ca848527c600f25d7d2433095d8c2b037dc108
SSDEEP 96:LcTcgyaWbk4btWfdGgMVZ75UmQPk4brj6XyVy5UmQulBUeVdVaDkbmJb7m62Fup4:Lv44wFGg+rx4XmXwMoMfwkbMGtqVPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

1704606494

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1704606494
Size 45KB
SHA256 124348872e337559071caeaa6aec455972e06d7f51a1b13c64add958c5869c67
MD5 a9bd73b61a92b2a6ef2e3089ff06150f
SHA1 dff3d288e9c8691d8ca7b343643c1bb6a1cada28
SHA512 01b4056cfd9c4537cbad474b2cca361daf06a07e006d94210c1ebff80296f201f9196691dd09dcc1cf67b1f4bd1e4f1861cbca187e87fbd23e55c2f55e81d7f2
SSDEEP 384:Lv/y6rUfBYWzZk7CPXujmKw7CPXu1IEg7CPXulXQiO/Hk8P41GJ:zL8JzWCPXb5CPX+cCPXtbf1gEJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 213B
SHA256 ef8c405271482e2fcb771d68e06bcd9f4640f1cb9456a061a4c01cc2dfbc7a5a
MD5 11fb7f2e3df374655fd7ff8a240ccfca
SHA1 f8bbe45b89874ba202cd0f9a866a4669b26d36e9
SHA512 d0bb3948e96081035c6ce1d7f1a6e6f81565a0f9f1ec3861fc7c0b51c192ce2d1f7170e62134a225511824531062d0e9ef7ce20c846029efb80f3ca696460628
MD5 SHA1 SHA512

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 416B
SHA256 b89098d845f1e8e6a08c5bbb507d83074a25976e2f7e6042fd6eba4635d56c3e
MD5 d33b3bf542c5cf9ba2198024f5ecc1b0
SHA1 c2e79c0a5e609d2d9646c5a9f521e159204dd1e7
SHA512 caee5c79eaf3741225ea200d18ef935cb6b2c3746b0a9ab9d240acfdbfd2770a5f61aa70f929f29de81533f1cbff21e5583b219b5d16ee5fb19aa4e6261a4bdb
MD5 SHA1 SHA512

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 629B
SHA256 f93dd41b9c20c1e77d51e1df528b9f15cf9e115325dbe01238af7c371a6dbb77
MD5 12e31a418126f4ed4112d5f011bcf021
SHA1 e5396c542255315d64a8ab3f1a93935324fcee32
SHA512 e73d1e55f2d44cd2e17d0d5dcda36725a185fddffe9d0ada999da3fb3d7168031fa3318b0b196dd637bf72035a81b538b2b2fdc597a948d49c13ce60876877e7
MD5 SHA1 SHA512

Submit Download

1704606455

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1704606455
Size 6KB
SHA256 8f2acf2ecfb1a58c493425348b52566f08c0c1285212dde87eedb702a26e49b0
MD5 b7a3c96915a233d13229affd404e149d
SHA1 de29506ea15323c91c1d7ea585c3b38b4d571138
SHA512 2d108672dfd8f69c608a0292ee22d0d41d5e1355b2aa38da77b50e4ae8b96867266a782498475609871e8dba018db40e6cc4a7b127be49b539abc033eb663dba
SSDEEP 192:Lv44wFGEjkwnr4XDIrNmbn+1CkkbdvtWV+7:L6Zk4Ay1CB/WV+7
MD5 SHA1 SHA512 SSDEEP

Submit Download

1704606494

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\88000045\1704606494
Size 6KB
SHA256 975c3268ee2fa349f247e5d2ccacfc68f415c65814541669ca7effe44c047bbc
MD5 4a805eb0c552171af04f4b3f0b3d0d7f
SHA1 7e0830133e7c09c5733c03e6ae6054dbd3034233
SHA512 51ab57e79f3a2b3a3dc311a9462960643536e4cc0bf5ff7cdbf8b037872511edc9c7bcf0577c75a0b1837aeaf920a1817cfe10b6bd966904c628ad57a3021e54
SSDEEP 96:LcTcgyaWbk4btWfdGEUnH4M5UmQgk4brjXUMgDoUUe5UmQ2BUpMmDkbmJb7m62TC:Lv44wFGEMFC4XD3g0aMjkbMGt9VPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

b44dc9e226ce402bbcb3ec71cc484b0c_1

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\b44dc9e226ce402bbcb3ec71cc484b0c_1
Size 1KB
SHA256 b7b0f8ca038f8c903669f0ffcb55167a66eb2ec8392a620f1a200c4280fd9fea
MD5 cf1a4e9ca906e8d4210c55066208d23e
SHA1 ff3f97c5151e3348df47f039a5b715256456835f
SHA512 3ae15a259b06fb8293a102bbb62f572d7d04ac70c9cf43af552a892f406701c21c6472e334bbc83bddedbb61ab911246fd76ab4ab14457038340557b813f3f28
MD5 SHA1 SHA512

Submit Download

memory/744-108-0x0000000000370000-0x0000000000376000-memory.dmp

Download

memory/744-111-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/744-116-0x0000000000370000-0x0000000000376000-memory.dmp

Download

memory/744-110-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/744-109-0x0000000000370000-0x0000000000376000-memory.dmp

Download

memory/820-38-0x0000000000120000-0x0000000000126000-memory.dmp

Download

memory/820-40-0x0000000000120000-0x0000000000126000-memory.dmp

Download

memory/952-27-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Download

memory/952-24-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Download

memory/952-104-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/952-105-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/952-106-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/1140-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1140-2-0x0000000002350000-0x0000000002D50000-memory.dmp

Download

memory/1140-10-0x0000000002350000-0x0000000002D50000-memory.dmp

Download

memory/1140-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/1140-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1196-185-0x00000000004D0000-0x00000000004D6000-memory.dmp

Download

memory/1196-183-0x00000000004D0000-0x00000000004D6000-memory.dmp

Download

memory/1328-91-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/1328-72-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/1328-71-0x0000000000580000-0x0000000000586000-memory.dmp

Download

memory/1328-70-0x0000000000580000-0x0000000000586000-memory.dmp

Download

memory/1488-186-0x0000000000E50000-0x0000000000E56000-memory.dmp

Download

memory/1488-184-0x0000000000E50000-0x0000000000E56000-memory.dmp

Download

memory/1728-32-0x0000000000430000-0x0000000000436000-memory.dmp

Download

memory/1728-35-0x0000000000430000-0x0000000000436000-memory.dmp

Download

memory/1880-34-0x00000000000D0000-0x00000000000D6000-memory.dmp

Download

memory/1880-30-0x00000000000D0000-0x00000000000D6000-memory.dmp

Download

memory/1908-113-0x0000000000990000-0x0000000000996000-memory.dmp

Download

memory/2020-63-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/2020-58-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/2020-56-0x0000000000B10000-0x0000000000B16000-memory.dmp

Download

memory/2020-55-0x0000000000B10000-0x0000000000B16000-memory.dmp

Download

memory/2132-7-0x0000000076FD2000-0x0000000076FD3000-memory.dmp

Download

memory/2132-4-0x0000000000950000-0x0000000000956000-memory.dmp

Download

memory/2132-12-0x0000000000950000-0x0000000000956000-memory.dmp

Download

memory/2172-112-0x00000000002B0000-0x00000000002B6000-memory.dmp

Download

memory/2432-152-0x0000000000EC0000-0x0000000000EC6000-memory.dmp

Download

memory/2472-17-0x0000000000430000-0x0000000000436000-memory.dmp

Download

memory/2472-138-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/2484-18-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2484-14-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2492-206-0x0000000000B50000-0x0000000000B56000-memory.dmp

Download

memory/2620-21-0x0000000000C30000-0x0000000000C36000-memory.dmp

Download

memory/2620-15-0x0000000000C30000-0x0000000000C36000-memory.dmp

Download

memory/2648-74-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/2648-73-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/2648-41-0x0000000000B70000-0x0000000000B76000-memory.dmp

Download

memory/2648-39-0x0000000000B70000-0x0000000000B76000-memory.dmp

Download

memory/3032-145-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/3032-144-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/3032-143-0x00007FFE508ED000-0x00007FFE508EE000-memory.dmp

Download

memory/3032-142-0x0000000000820000-0x0000000000826000-memory.dmp

Download

memory/3032-205-0x0000000000820000-0x0000000000826000-memory.dmp

Download

memory/3032-139-0x0000000000820000-0x0000000000826000-memory.dmp

Download

memory/3172-28-0x0000000000940000-0x0000000000946000-memory.dmp

Download

memory/3400-37-0x0000000000A80000-0x0000000000A86000-memory.dmp

Download

memory/3520-8-0x00007FFE508ED000-0x00007FFE508EE000-memory.dmp

Download

memory/3520-16-0x0000000000880000-0x0000000000886000-memory.dmp

Download

memory/3520-23-0x0000000000880000-0x0000000000886000-memory.dmp

Download

memory/3520-114-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/3520-6-0x0000000000870000-0x0000000000876000-memory.dmp

Download

memory/3532-33-0x00000000008D0000-0x00000000008D6000-memory.dmp

Download

memory/3532-29-0x00000000008D0000-0x00000000008D6000-memory.dmp

Download

memory/3652-237-0x0000000000630000-0x0000000000636000-memory.dmp

Download

memory/3680-19-0x0000000000C70000-0x0000000000C76000-memory.dmp

Download

memory/3680-25-0x0000000000C70000-0x0000000000C76000-memory.dmp

Download

memory/3932-20-0x0000000000500000-0x0000000000506000-memory.dmp

Download

memory/3936-236-0x0000000000040000-0x0000000000046000-memory.dmp

Download

memory/4008-120-0x00000000008B0000-0x00000000008B6000-memory.dmp

Download

memory/4028-26-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Download

memory/4028-22-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Download

memory/4028-75-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/4028-107-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/4160-238-0x00000000006B0000-0x00000000006B6000-memory.dmp

Download

memory/4160-241-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/4160-242-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/4508-141-0x00000000003E0000-0x00000000003E6000-memory.dmp

Download

memory/4508-140-0x00000000003E0000-0x00000000003E6000-memory.dmp

Download

memory/4768-213-0x0000000000800000-0x0000000000806000-memory.dmp

Download

memory/4820-208-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/4820-156-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/4820-154-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Download

memory/4820-151-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Download

memory/4824-31-0x0000000000E20000-0x0000000000E26000-memory.dmp

Download

memory/4824-36-0x0000000000E20000-0x0000000000E26000-memory.dmp

Download

memory/4876-153-0x00000000004E0000-0x00000000004E6000-memory.dmp

Download

memory/5112-119-0x0000000000010000-0x0000000000016000-memory.dmp

Download