Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/05/2026, 23:24
Behavioral task
behavioral1
Sample
2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe
- Size 388KB
- Sample260516-3dptcsdy7p
- SHA256 0a7ffc7584b23ff16e0cd09cfe7b76734478f593b5d90b22edceefabd4aea630
- MD5 0f415c14b90455d447fa60189646bccc
- SHA1 4a7b1d54e8b82ecaa170bf5869ea711646186575
- SHA512 128ae9f0ccee94bbe54d823ebd0b88cd1aa3fc405fbe7557d1e28b74a950181ec10d2dce7c03396ae046ee8465bf172ff198898a3d3fad3f014180e76c2a1edb
- SSDEEP 6144:dYjwO9wz4ZoeETEW1gbpJA3KpSL0pDOe5ebJ7fR:pO9ULePJA3KY0pxo
- TLSH T110844A43F6D080BAD4AE503948625614A37AFC219B62EBDB124C35ED0E73BC59D34FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral1/memory/4304-0-0x0000023848850000-0x00000238488B6000-memory.dmp family_sheetrat_v1 - Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
resource yara_rule behavioral1/memory/4304-0-0x0000023848850000-0x00000238488B6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Process not Found - Executes dropped EXE 35 IoCs
pid Process 3300 Process not Found 2156 Process not Found 728 Process not Found 1908 Process not Found 1064 Process not Found 3116 Process not Found 2532 Process not Found 2992 Process not Found 1496 Process not Found 1712 Process not Found 3452 Process not Found 3460 Process not Found 2872 Process not Found 676 Process not Found 1228 Process not Found 3796 Process not Found 1732 Process not Found 4796 Process not Found 2236 Process not Found 1000 Process not Found 1884 Process not Found 1296 Process not Found 1424 Process not Found 1036 Process not Found 2208 Process not Found 616 Process not Found 2796 Process not Found 628 Process not Found 1216 Process not Found 2784 Process not Found 788 Process not Found 996 Process not Found 4932 Process not Found 2764 Process not Found 2960 Process not Found - Loads dropped DLL 2 IoCs
pid Process 3496 Process not Found 4072 Process not Found - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Process not Found - Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Process not Found - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found - Modifies data under HKEY_USERS 54 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1779283179" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={3166F8C9-8DA4-4846-B81D-B536ED5E7121}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" Process not Found Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 20 May 2026 13:19:39 GMT" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a51f7305-31a9-4da1-8 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5581fa9c-6285-4496-a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f539b7215be8dc01f539b7215be8dc01f539b7215be8dc01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b45c4b6a2000326636353332316661623964333232313363643466613239393237643265396561656664323265613837656637336662396363333835306530643632366365320000b20009000400efbeb45c4b6ab45c4b6a2e000000000000000000000000000000000000000000000000000b290600320066003600350033003200310066006100620039006400330032003200310033006300640034006600610032003900390032003700640032006500390065006100650066006400320032006500610038003700650066003700330066006200390063006300330038003500300065003000640036003200360063006500320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000b95085df1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32663635333231666162396433323231336364346661323939323764326539656165666432326561383765663733666239636333383530653064363236636532000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007270686a6e796c6a00000000000000008c580e533e68af40b6b35d23256a70f6b41b8ed8164ff111b40ada48ec94345f8c580e533e68af40b6b35d23256a70f6b41b8ed8164ff111b40ada48ec94345fce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003500340030003000350032003800380034002d0032003900360039003400340030003500300034002d003400360034003700380032003400330035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000aea20acd000000000000d01200000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "134231831017190673" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "134231831019065633" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d2da7a3d-70a9-41f6-8 = 4c86b0215be8dc01 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64c1314d-ec92-45ef-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1be468af-68fd-4eeb-9 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1be468af-68fd-4eeb-9 = "\\\\?\\Volume{CD0AA2AE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ed1c5ff6420aff71c83f0976e53e8075352448529a8cc1d786ba0a7a3df0ece3" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1be468af-68fd-4eeb-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001b26c3215be8dc011b26c3215be8dc011b26c3215be8dc01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b45c4c6a2000656431633566663634323061666637316338336630393736653533653830373533353234343835323961386363316437383662613061376133646630656365330000b20009000400efbeb45c4c6ab45c4c6a2e00000000000000000000000000000000000000000000000000e5692b01650064003100630035006600660036003400320030006100660066003700310063003800330066003000390037003600650035003300650038003000370035003300350032003400340038003500320039006100380063006300310064003700380036006200610030006100370061003300640066003000650063006500330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000b95085df1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65643163356666363432306166663731633833663039373665353365383037353335323434383532396138636331643738366261306137613364663065636533000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007270686a6e796c6a00000000000000008c580e533e68af40b6b35d23256a70f6b61b8ed8164ff111b40ada48ec94345f8c580e533e68af40b6b35d23256a70f6b61b8ed8164ff111b40ada48ec94345fce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003500340030003000350032003800380034002d0032003900360039003400340030003500300034002d003400360034003700380032003400330035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000aea20acd000000000000d01200000000000000000000000000000000 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5357dcfc-8cfe-4a6b-a Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5357dcfc-8cfe-4a6b-a = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134237567418346277" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64c1314d-ec92-45ef-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000009d0d9d215be8dc019d0d9d215be8dc019d0d9d215be8dc01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b45c4b6a2000626661366662346538333931396339343963356564306566393635366264366465393465336438316637333937356664613338626666666166653636383664640000b20009000400efbeb45c4b6ab45c4b6a2e0000000000000000000000000000000000000000000000000063552000620066006100360066006200340065003800330039003100390063003900340039006300350065006400300065006600390036003500360062006400360064006500390034006500330064003800310066003700330039003700350066006400610033003800620066006600660061006600650036003600380036006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000b95085df1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62666136666234653833393139633934396335656430656639363536626436646539346533643831663733393735666461333862666666616665363638366464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007270686a6e796c6a00000000000000008c580e533e68af40b6b35d23256a70f6b11b8ed8164ff111b40ada48ec94345f8c580e533e68af40b6b35d23256a70f6b11b8ed8164ff111b40ada48ec94345fce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003500340030003000350032003800380034002d0032003900360039003400340030003500300034002d003400360034003700380032003400330035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000aea20acd000000000000d01200000000000000000000000000000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a51f7305-31a9-4da1-8 = "8324" Process not Found Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5357dcfc-8cfe-4a6b-a Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1be468af-68fd-4eeb-9 Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9927868-e41e-415a-8 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9927868-e41e-415a-8 = "\\\\?\\Volume{CD0AA2AE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c02d59edba76d6ac50a8dce51882c47c686179265769ee631eb4a0b5948d7e6e" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64c1314d-ec92-45ef-9 = 3706a6215be8dc01 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5581fa9c-6285-4496-a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a256911-f1fb-4b8c-9 = "8324" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\adf51d66-fb96-4073-a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8bf2adcb-6027-4f5f-8 = "0" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9927868-e41e-415a-8 = eaceda225be8dc01 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134237567021471213" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\adf51d66-fb96-4073-a = "0" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8bf2adcb-6027-4f5f-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8bf2adcb-6027-4f5f-8 = "8324" Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5357dcfc-8cfe-4a6b-a Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\adf51d66-fb96-4073-a Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0dcc1c6c-3bba-459c-b Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5581fa9c-6285-4496-a = "8324" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9927868-e41e-415a-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d2da7a3d-70a9-41f6-8 = "0" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a51f7305-31a9-4da1-8 = "\\\\?\\Volume{CD0AA2AE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c02d59edba76d6ac50a8dce51882c47c686179265769ee631eb4a0b5948d7e6e" Process not Found Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a256911-f1fb-4b8c-9 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134237567946314919" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64c1314d-ec92-45ef-9 = "8324" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5357dcfc-8cfe-4a6b-a = "\\\\?\\Volume{CD0AA2AE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\2f65321fab9d32213cd4fa29927d2e9eaefd22ea87ef73fb9cc3850e0d626ce2" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9927868-e41e-415a-8 = "0" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a51f7305-31a9-4da1-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\352ada5a-38b1-4b3c-8 = 9e1393265be8dc01 Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134237567916627453" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d2da7a3d-70a9-41f6-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a256911-f1fb-4b8c-9 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134237566840171980" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134237567101627466" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\352ada5a-38b1-4b3c-8 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64c1314d-ec92-45ef-9 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5357dcfc-8cfe-4a6b-a = 6be27a225be8dc01 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a51f7305-31a9-4da1-8 = "0" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2a256911-f1fb-4b8c-9 = d1a3c3215be8dc01 Process not Found Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1be468af-68fd-4eeb-9 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134237567116002668" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d2da7a3d-70a9-41f6-8 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c0eba8215be8dc01c0eba8215be8dc01c0eba8215be8dc01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b45c4b6a2000363137383534326436336464326564353831313635643966653532366461343239316332666134333432343534383339316461386366343838353264373362610000b20009000400efbeb45c4b6ab45c4b6a2e0000000000000000000000000000000000000000000000000040771400360031003700380035003400320064003600330064006400320065006400350038003100310036003500640039006600650035003200360064006100340032003900310063003200660061003400330034003200340035003400380033003900310064006100380063006600340038003800350032006400370033006200610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000b95085df1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36313738353432643633646432656435383131363564396665353236646134323931633266613433343234353438333931646138636634383835326437336261000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007270686a6e796c6a00000000000000008c580e533e68af40b6b35d23256a70f6b21b8ed8164ff111b40ada48ec94345f8c580e533e68af40b6b35d23256a70f6b21b8ed8164ff111b40ada48ec94345fce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003500340030003000350032003800380034002d0032003900360039003400340030003500300034002d003400360034003700380032003400330035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000aea20acd000000000000d01200000000000000000000000000000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a51f7305-31a9-4da1-8 = 8e04b6215be8dc01 Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\adf51d66-fb96-4073-a = e04e81225be8dc01 Process not Found Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\352ada5a-38b1-4b3c-8 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\352ada5a-38b1-4b3c-8 = "0" Process not Found - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4304 2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe 4304 2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe 4304 2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3300 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4304 2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe Token: SeShutdownPrivilege 3300 Process not Found Token: SeCreatePagefilePrivilege 3300 Process not Found Token: SeShutdownPrivilege 3300 Process not Found Token: SeCreatePagefilePrivilege 3300 Process not Found Token: SeShutdownPrivilege 3300 Process not Found Token: SeCreatePagefilePrivilege 3300 Process not Found Token: SeAuditPrivilege 2764 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeTcbPrivilege 788 Process not Found Token: SeAssignPrimaryTokenPrivilege 2236 Process not Found Token: SeIncreaseQuotaPrivilege 2236 Process not Found Token: SeSecurityPrivilege 2236 Process not Found Token: SeTakeOwnershipPrivilege 2236 Process not Found Token: SeLoadDriverPrivilege 2236 Process not Found Token: SeSystemtimePrivilege 2236 Process not Found Token: SeBackupPrivilege 2236 Process not Found Token: SeRestorePrivilege 2236 Process not Found Token: SeShutdownPrivilege 2236 Process not Found Token: SeSystemEnvironmentPrivilege 2236 Process not Found Token: SeUndockPrivilege 2236 Process not Found Token: SeManageVolumePrivilege 2236 Process not Found Token: SeAssignPrimaryTokenPrivilege 2236 Process not Found Token: SeIncreaseQuotaPrivilege 2236 Process not Found Token: SeSecurityPrivilege 2236 Process not Found Token: SeTakeOwnershipPrivilege 2236 Process not Found Token: SeLoadDriverPrivilege 2236 Process not Found Token: SeSystemtimePrivilege 2236 Process not Found Token: SeBackupPrivilege 2236 Process not Found Token: SeRestorePrivilege 2236 Process not Found Token: SeShutdownPrivilege 2236 Process not Found Token: SeSystemEnvironmentPrivilege 2236 Process not Found Token: SeUndockPrivilege 2236 Process not Found Token: SeManageVolumePrivilege 2236 Process not Found Token: SeAssignPrimaryTokenPrivilege 2236 Process not Found Token: SeIncreaseQuotaPrivilege 2236 Process not Found Token: SeSecurityPrivilege 2236 Process not Found Token: SeTakeOwnershipPrivilege 2236 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 788 wrote to memory of 3948 788 Process not Found 92 PID 788 wrote to memory of 4800 788 Process not Found 93 PID 788 wrote to memory of 2496 788 Process not Found 94 PID 788 wrote to memory of 4568 788 Process not Found 95 PID 788 wrote to memory of 3976 788 Process not Found 97 PID 788 wrote to memory of 1760 788 Process not Found 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_0f415c14b90455d447fa60189646bccc_amadey_cobalt-strike_darkgate_ghostweaver_glassworm_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:3948
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4800
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:2496
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:4568
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3976
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1779283101
- Size 2KB
- SHA256 6d4f85e7b31e10ff9bad8ebcd05cf7551b284ca39c9085b50caa24d9eea7547b
- MD5 a35c0b9fdfb1d51bbb10bdb3a890b404
- SHA1 e14a86bde273204697b9043cab8663bac77d9f0a
- SHA512 2b27cc0d8202ede7242ec78e67ea401d9a7179c04c52a3557ec25390145b8e0e5bde8bff51be7027b5cdc127aee92617ba7f3b9c9820087f39e31930b71a3ffa
- TLSH T1A051946CA7D80159F7FE9A47C5FB546EB9373C063805D81D00912F4E0A32B42F992B2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1779283101
- Size 50KB
- SHA256 09042f5dedb6bd65bf04ebcca46d9e6facede2b7955b833477080c51de68b654
- MD5 689dc3d1c4f9baf81ff7941951c1d3ef
- SHA1 d6005cd97d625c70529129d915e2d14deddee431
- SHA512 25b55ff66dab27f26e1ba6296932f14557523b3c81c1173bc380b732038012f15d3fff1f3b26cb260e0ab1a64b9d0408fe7529f196a11e06b47a60067e8a83de
- SSDEEP 768:PS7LAJ7/m7VtRAg6nFErnRBfkbg6Sv/244Fn4kvg6k:PltV6Rxb
- TLSH T17633D82C7AED1119F3BBEA82CFF6836F953778552917C52D08811F0E0562E41B993A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1779283101
- Size 4KB
- SHA256 3c672843386547e982ff4dd2df4d2c87c16136537b3d430363bb0ce45188411d
- MD5 9500fd19b733bd58f87e7094b7158f6b
- SHA1 dac3d5abdd87e9acfc312630350aa9382c7bdf47
- SHA512 6ccb02a923f4ddfc7a76a458f8ff3d50c5a017c8f64ced063024a9daf340431a9814229fdb65182d2393ad6bd1d4c73ea19e2ea116dea48545308d7700d3e807
- SSDEEP 96:LcTcg8Jk4bj03q2UG8Kk4bR03qI33quO33qg:L24c7K4W7nanh
- TLSH T15791886CB7D80256F7FFDA46C5FA146EA5367D463805E81D00D21F4E0E22B41F991B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1779283101
- Size 336B
- SHA256 2e475c24bf3431f0d0e1fc23897cc1cf4917bf76198db97c7773171611c2833d
- MD5 3af786c86d35b2b3cf866d5ebf704f9c
- SHA1 b16b00661b85d60ca110501773090cfe54f23d3e
- SHA512 5215adfcb6238f3b59a871500132edef99a3f5b9ca3d7cb05ce03b1c08534898103bfffd60cff010db7ed4d2105cc3c134bdd66289de200ab566ff9522f1a0a9
- TLSH T1AEE0C28E97F5110DF670BB0355F3604D58393C85AC7AD11E40812F0E0832E41E521B27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\10b61e1b-a2ec-4814-8492-c58b1d05e44f.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH