tinba | e2652df4d4e8d94a40abaa555fab51768159de117b4e756bee20a5dfbca82bc1

Analysis

max time kernel
156s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8c5e370665d8dcc7871514817ccb4a9.exe
Size 49KB
Sample240320-pc65csha4t
SHA256 e2652df4d4e8d94a40abaa555fab51768159de117b4e756bee20a5dfbca82bc1
MD5 d8c5e370665d8dcc7871514817ccb4a9
SHA1 24b134757121888198726c8f3bc6f43bde73fd17
SHA512 030ff3efcbb69dfba32665d676b2df102cf7170e1f6ad351b9380fa59c6f27b22c0e55be0033645a638e4c12ae834356d474d34d18e7a7848e0caa9fa452c17b
SSDEEP 768:DCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:3bw/6plBTFBYNNR9Jw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B5AA158F = "C:\\Users\\Admin\\AppData\\Roaming\\B5AA158F\\bin.exe"	winver.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	backgroundTaskHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	backgroundTaskHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32 = "\\\\?\\Volume{D2BBEF64-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e49fbba90ecbf4de08b7ea734faeb3eee73eb09e932a19ac8681736106c7d162"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	backgroundTaskHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9 = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c09ac624c07ada01c09ac624c07ada01c09ac624c07ada01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000007458cc612000656462363138633535653534653666643939646363383665653134616132626438313966306564386265613837336462363939363931323232346231323464640000b20009000400efbe7458cc617458cc612e0000000000000000000000000000000000000000000000000040359600650064006200360031003800630035003500650035003400650036006600640039003900640063006300380036006500650031003400610061003200620064003800310039006600300065006400380062006500610038003700330064006200360039003900360039003100320032003200340062003100320034006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c845fbd41000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65646236313863353565353465366664393964636338366565313461613262643831396630656438626561383733646236393936393132323234623132346464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f61696c76636e790000000000000000dc761bea64692643b2a600e7d98318f4ec17fe38c1d4ee11b9f75a176b010e55dc761bea64692643b2a600e7d98318f4ec17fe38c1d4ee11b9f75a176b010e55d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003800300038003000360035003700330038002d0031003600360036003200370037003600310033002d0031003100320035003800340036003100340036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000064efbbd2000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3 = 0bf8e124c07ada01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c = 71c9d024c07ada01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba = "\\\\?\\Volume{D2BBEF64-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\f129dbafb63b6a1f2c77b8b179dcd49c5e9e58c27e1e71fa3c57d4867302ab74"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f512bd24c07ada01f512bd24c07ada01f512bd24c07ada01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000007458cc612000653439666262613930656362663464653038623765613733346661656233656565373365623039653933326131396163383638313733363130366337643136320000b20009000400efbe7458cc617458cc612e000000000000000000000000000000000000000000000000000bbd9f00650034003900660062006200610039003000650063006200660034006400650030003800620037006500610037003300340066006100650062003300650065006500370033006500620030003900650039003300320061003100390061006300380036003800310037003300360031003000360063003700640031003600320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c845fbd41000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65343966626261393065636266346465303862376561373334666165623365656537336562303965393332613139616338363831373336313036633764313632000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f61696c76636e790000000000000000dc761bea64692643b2a600e7d98318f4eb17fe38c1d4ee11b9f75a176b010e55dc761bea64692643b2a600e7d98318f4eb17fe38c1d4ee11b9f75a176b010e55d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003800300038003000360035003700330038002d0031003600360036003200370037003600310033002d0031003100320035003800340036003100340036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000064efbbd2000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000cd24d024c07ada01cd24d024c07ada01cd24d024c07ada01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000007458cc612000663132396462616662363362366131663263373762386231373964636434396335653965353863323765316537316661336335376434383637333032616237340000b20009000400efbe7458cc617458cc612e0000000000000000000000000000000000000000000000000033ab8c00660031003200390064006200610066006200360033006200360061003100660032006300370037006200380062003100370039006400630064003400390063003500650039006500350038006300320037006500310065003700310066006100330063003500370064003400380036003700330030003200610062003700340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c845fbd41000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66313239646261666236336236613166326337376238623137396463643439633565396535386332376531653731666133633537643438363733303261623734000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f61696c76636e790000000000000000dc761bea64692643b2a600e7d98318f4ed17fe38c1d4ee11b9f75a176b010e55dc761bea64692643b2a600e7d98318f4ed17fe38c1d4ee11b9f75a176b010e55d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003800300038003000360035003700330038002d0031003600360036003200370037003600310033002d0031003100320035003800340036003100340036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000064efbbd2000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581 = "\\\\?\\Volume{D2BBEF64-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a549905d95afc85c3fed8b3e15e28adee39ea1be20e1e36ee7865d03f993bf0f"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\69580d82-8699-458a	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c04f7a24c07ada01c04f7a24c07ada01c04f7a24c07ada01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000007458cc612000323837356534386566313434333632636231333136356630383764376637636133316364383161363462663032363666653165623130663335353562656265300000b20009000400efbe7458cc617458cc612e000000000000000000000000000000000000000000000000004080e200320038003700350065003400380065006600310034003400330036003200630062003100330031003600350066003000380037006400370066003700630061003300310063006400380031006100360034006200660030003200360036006600650031006500620031003000660033003500350035006200650062006500300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c845fbd41000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32383735653438656631343433363263623133313635663038376437663763613331636438316136346266303236366665316562313066333535356265626530000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f61696c76636e790000000000000000dc761bea64692643b2a600e7d98318f4ea17fe38c1d4ee11b9f75a176b010e55dc761bea64692643b2a600e7d98318f4ea17fe38c1d4ee11b9f75a176b010e55d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003800300038003000360035003700330038002d0031003600360036003200370037003600310033002d0031003100320035003800340036003100340036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000064efbbd2000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9 = d15d8624c07ada01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9 = "\\\\?\\Volume{D2BBEF64-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\2875e48ef144362cb13165f087d7f7ca31cd81a64bf0266fe1eb10f3555bebe0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32 = e673c524c07ada01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3 = "\\\\?\\Volume{D2BBEF64-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\33ec74d2ee66662d3fa67fb3a6ceb455d8f3666393c8976e8aee9efc414c977c"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a3b0d924c07ada01a3b0d924c07ada01a3b0d924c07ada01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000007458cc612000333365633734643265653636363632643366613637666233613663656234353564386633363636333933633839373665386165653965666334313463393737630000b20009000400efbe7458cc617458cc612e000000000000000000000000000000000000000000000000005d1f8300330033006500630037003400640032006500650036003600360036003200640033006600610036003700660062003300610036006300650062003400350035006400380066003300360036003600330039003300630038003900370036006500380061006500650039006500660063003400310034006300390037003700630000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c845fbd41000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33336563373464326565363636363264336661363766623361366365623435356438663336363633393363383937366538616565396566633431346339373763000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f61696c76636e790000000000000000dc761bea64692643b2a600e7d98318f4ee17fe38c1d4ee11b9f75a176b010e55dc761bea64692643b2a600e7d98318f4ee17fe38c1d4ee11b9f75a176b010e55d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003800300038003000360035003700330038002d0031003600360036003200370037003600310033002d0031003100320035003800340036003100340036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000064efbbd2000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32 = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	backgroundTaskHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1bcd8498-9cd6-4bdf	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36fec3e6-77a3-4fb3 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581 = 9c5df324c07ada01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba = 1f90d724c07ada01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\219f2de3-7051-40dd	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\562665b4-54b5-4cf9 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581 = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e797f28a-b4ca-48ba	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581 = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6b4255a-d6c5-4581 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000cdd6e024c07ada01cdd6e024c07ada01cdd6e024c07ada01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000007458cc612000613534393930356439356166633835633366656438623365313565323861646565333965613162653230653165333665653738363564303366393933626630660000b20009000400efbe7458cc617458cc612e0000000000000000000000000000000000000000000000000033f97b00610035003400390039003000350064003900350061006600630038003500630033006600650064003800620033006500310035006500320038006100640065006500330039006500610031006200650032003000650031006500330036006500650037003800360035006400300033006600390039003300620066003000660000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000c845fbd41000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61353439393035643935616663383563336665643862336531356532386164656533396561316265323065316533366565373836356430336639393362663066000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006f61696c76636e790000000000000000dc761bea64692643b2a600e7d98318f4f117fe38c1d4ee11b9f75a176b010e55dc761bea64692643b2a600e7d98318f4f117fe38c1d4ee11b9f75a176b010e55d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003800300038003000360035003700330038002d0031003600360036003200370037003600310033002d0031003100320035003800340036003100340036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000064efbbd2000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a25c19ef-9303-4185	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\603a2954-01d1-4f32 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\181015f9-c465-4a5c = "\\\\?\\Volume{D2BBEF64-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\edb618c55e54e6fd99dcc86ee14aa2bd819f0ed8bea873db6996912224b124dd"	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe
4596	winver.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	4072	RuntimeBroker.exe
Token: SeShutdownPrivilege	4072	RuntimeBroker.exe
Token: SeShutdownPrivilege	4072	RuntimeBroker.exe
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	4072	RuntimeBroker.exe
Token: SeDebugPrivilege	3160	backgroundTaskHost.exe
Token: SeDebugPrivilege	3160	backgroundTaskHost.exe
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE
Token: SeShutdownPrivilege	3348	Explorer.EXE
Token: SeCreatePagefilePrivilege	3348	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4596	winver.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3348	Explorer.EXE
3968	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4596	2496	d8c5e370665d8dcc7871514817ccb4a9.exe	100
PID 2496 wrote to memory of 4596	2496	d8c5e370665d8dcc7871514817ccb4a9.exe	100
PID 2496 wrote to memory of 4596	2496	d8c5e370665d8dcc7871514817ccb4a9.exe	100
PID 2496 wrote to memory of 4596	2496	d8c5e370665d8dcc7871514817ccb4a9.exe	100
PID 4596 wrote to memory of 3348	4596	winver.exe	57
PID 4596 wrote to memory of 2408	4596	winver.exe	42
PID 4596 wrote to memory of 2440	4596	winver.exe	43
PID 4596 wrote to memory of 2524	4596	winver.exe	45
PID 4596 wrote to memory of 3348	4596	winver.exe	57
PID 4596 wrote to memory of 3624	4596	winver.exe	58
PID 4596 wrote to memory of 3864	4596	winver.exe	59
PID 4596 wrote to memory of 3968	4596	winver.exe	60
PID 4596 wrote to memory of 4072	4596	winver.exe	61
PID 4596 wrote to memory of 784	4596	winver.exe	62
PID 4596 wrote to memory of 4148	4596	winver.exe	63
PID 4596 wrote to memory of 5056	4596	winver.exe	65
PID 4596 wrote to memory of 1116	4596	winver.exe	75
PID 4596 wrote to memory of 2984	4596	winver.exe	77
PID 4596 wrote to memory of 3148	4596	winver.exe	78
PID 4596 wrote to memory of 1616	4596	winver.exe	79
PID 4596 wrote to memory of 728	4596	winver.exe	80
PID 4596 wrote to memory of 496	4596	winver.exe	81
PID 4596 wrote to memory of 1088	4596	winver.exe	83
PID 4596 wrote to memory of 1384	4596	winver.exe	84
PID 4596 wrote to memory of 4364	4596	winver.exe	90
PID 4596 wrote to memory of 2084	4596	winver.exe	91
PID 4596 wrote to memory of 216	4596	winver.exe	92
PID 4596 wrote to memory of 2556	4596	winver.exe	97
PID 4596 wrote to memory of 1544	4596	winver.exe	98
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112
PID 2984 wrote to memory of 2272	2984	msedge.exe	112

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2440

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2524

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3348
- C:\Users\Admin\AppData\Local\Temp\d8c5e370665d8dcc7871514817ccb4a9.exe
  "C:\Users\Admin\AppData\Local\Temp\d8c5e370665d8dcc7871514817ccb4a9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3624

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3864

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of UnmapMainImage
PID:3968

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5056

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe83262e98,0x7ffe83262ea4,0x7ffe83262eb0
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2896 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2916 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3128 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5284 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5480 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2272

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:4364

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2084

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:216

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:1544

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Modifies registry class
PID:4780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:4844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4844 -s 848
  2⤵
  PID:2992

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2516

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1960

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1704

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1710936859

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280815\1710936859
Size 6KB
SHA256 81263b52e6fc3ccc2dfcadb7ba174ad745eeb1d3fd6e6bfe1b606c7df36f1f30
MD5 a98b87944bdd57448319a102a215804f
SHA1 1cd3f9729862ab8fdc7f053d62b17b61383ece6e
SHA512 0dc23bd8207e175f3d39705f4f6ca9ffed59a1e4f8bd5f5357fc30f31605ef4c1b9ff7a2971e78aef01053cdb95093e6190973c3668edba5e8df303b50c1237e
SSDEEP 192:Lv44wFGg12Z2IM4XmXB2It926kb9vLtqVBrg:L6r12Z2HR2I92v9ZqVB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

1710936859

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1710936859
Size 44KB
SHA256 2a0e805bd4e7d1731ce26664e69bce4903ff413a7c7f64f58bebbcac49ccb4ab
MD5 32312211b46c8cf089b3284842d05878
SHA1 2fc09a48e59df20f21e5da02083cf9f1d9f48d5d
SHA512 0889b883345626219f6961a844f64dd925fdc4dce834ef50409130b4b6e9a12a260b2f23b24386d94f5aa23debd6e13fbf1e88ea3274d8d51c0a4c71bedd5f3f
SSDEEP 768:Wo7v/AvdvR+2sKwqdLsKwtfsKw7i7iIiT:F2saLsnfsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

1710936822

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1710936822
Size 6KB
SHA256 927acbd675c0803326fbb938a96df418cb23a20c73eee9576ad11923d6760bac
MD5 033fbb2b232ccb74093f765732712048
SHA1 2651756d7640b78ce96fb927b6edcc963d6853a7
SHA512 3f8f5189c3dd1f0feb76ca448c4f38bde2992ce1cacbea35a5cc228c88f45f932f212d800df70cf49206418b3db044d7a47aa5a7dd242fe7cd0f66e5f94dec51
SSDEEP 192:Lv44wFGEj5292II4XDIrv72IEt26kbivBtWVQr0:L6Z5292Jn2ht2vUbWVQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1710936859

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\88000045\1710936859
Size 6KB
SHA256 c06328eaf5d63aff64cce738a7b01a798c3d014a459b84a5a29295aa67c558a6
MD5 2833d57fe837eb3a3a906fac885cbef9
SHA1 e86f830e0f12ba6f6bbd3f213a721c4d0feed84c
SHA512 0325765ddf83e20dc500ce78f5c23fc0295d9045483d0af8c6f589f158212bbbc746aeed8a89b15e440229a5641f37df18213c95c1dcf1c1be0b8ca75073c53b
SSDEEP 192:Lv44wFGEM32Z2I4y4XD3gWj2I42F26kb9vLt9VBrg:L6W32Z2N3B2N2F2v9Z9VB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

4a2abb888ba34c6ba7706f8943fa4b93_1

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\4a2abb888ba34c6ba7706f8943fa4b93_1
Size 1KB
SHA256 fc086cc891f65d989d0d6aea10e7f679c635c730ab888ea51af5084442b4e095
MD5 9a62e832eb0f263fc2397a2de3ddcfd9
SHA1 3d9b9ebad958611fcb68c84e46b5bb23bd8360ee
SHA512 ad951dca31e89bfaf46b7397c0d649b925033d057074d740769cadbfd0dc29ad37a87f1fb17532f3ea2e80809aee11a9f2f3b3e9ac99d3961815f5401c18ae49
MD5 SHA1 SHA512

Submit Download

memory/432-159-0x00000000002C0000-0x00000000002C6000-memory.dmp

Download

memory/784-27-0x00000000008E0000-0x00000000008E6000-memory.dmp

Download

memory/1116-32-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/1116-30-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/1116-48-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/1544-37-0x00000000001D0000-0x00000000001D6000-memory.dmp

Download

memory/1544-39-0x00000000001D0000-0x00000000001D6000-memory.dmp

Download

memory/1544-93-0x00007FFEAA830000-0x00007FFEAA831000-memory.dmp

Download

memory/1544-53-0x00007FFEAA820000-0x00007FFEAA821000-memory.dmp

Download

memory/1544-54-0x00007FFEAA840000-0x00007FFEAA841000-memory.dmp

Download

memory/1608-101-0x0000000000830000-0x0000000000836000-memory.dmp

Download

memory/1704-151-0x00000000002F0000-0x00000000002F6000-memory.dmp

Download

memory/1960-150-0x00000000002B0000-0x00000000002B6000-memory.dmp

Download

memory/2084-35-0x0000000000970000-0x0000000000976000-memory.dmp

Download

memory/2408-16-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/2408-143-0x00007FFEAA830000-0x00007FFEAA831000-memory.dmp

Download

memory/2440-18-0x0000000000860000-0x0000000000866000-memory.dmp

Download

memory/2440-13-0x0000000000860000-0x0000000000866000-memory.dmp

Download

memory/2496-0-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/2496-1-0x0000000002330000-0x0000000002D30000-memory.dmp

Download

memory/2496-2-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2496-9-0x0000000002330000-0x0000000002D30000-memory.dmp

Download

memory/2516-75-0x0000000000D00000-0x0000000000D06000-memory.dmp

Download

memory/2524-21-0x0000000000B80000-0x0000000000B86000-memory.dmp

Download

memory/2524-14-0x0000000000B80000-0x0000000000B86000-memory.dmp

Download

memory/2556-36-0x0000000000410000-0x0000000000416000-memory.dmp

Download

memory/2556-38-0x0000000000410000-0x0000000000416000-memory.dmp

Download

memory/2992-83-0x00000000008E0000-0x00000000008E6000-memory.dmp

Download

memory/2992-84-0x00000000008E0000-0x00000000008E6000-memory.dmp

Download

memory/3160-88-0x0000000000030000-0x0000000000036000-memory.dmp

Download

memory/3160-92-0x00007FFEAA830000-0x00007FFEAA831000-memory.dmp

Download

memory/3160-89-0x00007FFEAA6AD000-0x00007FFEAA6AE000-memory.dmp

Download

memory/3160-144-0x0000000000030000-0x0000000000036000-memory.dmp

Download

memory/3160-87-0x0000000000030000-0x0000000000036000-memory.dmp

Download

memory/3160-90-0x00007FFEAA6AC000-0x00007FFEAA6AD000-memory.dmp

Download

memory/3160-91-0x00007FFEAA840000-0x00007FFEAA841000-memory.dmp

Download

memory/3348-7-0x00007FFEAA6AD000-0x00007FFEAA6AE000-memory.dmp

Download

memory/3348-20-0x0000000000D60000-0x0000000000D66000-memory.dmp

Download

memory/3348-15-0x0000000000D60000-0x0000000000D66000-memory.dmp

Download

memory/3348-76-0x00007FFEAA820000-0x00007FFEAA821000-memory.dmp

Download

memory/3348-5-0x0000000000C70000-0x0000000000C76000-memory.dmp

Download

memory/3356-100-0x00000000002B0000-0x00000000002B6000-memory.dmp

Download

memory/3624-17-0x0000000000600000-0x0000000000606000-memory.dmp

Download

memory/3624-23-0x0000000000600000-0x0000000000606000-memory.dmp

Download

memory/3864-19-0x0000000000670000-0x0000000000676000-memory.dmp

Download

memory/3968-25-0x00000000003F0000-0x00000000003F6000-memory.dmp

Download

memory/3968-22-0x00000000003F0000-0x00000000003F6000-memory.dmp

Download

memory/4072-26-0x0000000000570000-0x0000000000576000-memory.dmp

Download

memory/4072-24-0x0000000000570000-0x0000000000576000-memory.dmp

Download

memory/4148-28-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/4148-31-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/4364-34-0x0000000000AB0000-0x0000000000AB6000-memory.dmp

Download

memory/4596-11-0x0000000002BF0000-0x0000000002BF6000-memory.dmp

Download

memory/4596-3-0x0000000002BF0000-0x0000000002BF6000-memory.dmp

Download

memory/4596-6-0x0000000077A12000-0x0000000077A13000-memory.dmp

Download

memory/4780-61-0x00007FFEAA830000-0x00007FFEAA831000-memory.dmp

Download

memory/4780-59-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Download

memory/4780-60-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Download

memory/4780-62-0x00007FFEAA840000-0x00007FFEAA841000-memory.dmp

Download

memory/4780-82-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Download

memory/4844-74-0x00000000009F0000-0x00000000009F6000-memory.dmp

Download

memory/5056-29-0x0000000000270000-0x0000000000276000-memory.dmp

Download

memory/5056-33-0x0000000000270000-0x0000000000276000-memory.dmp

Download