Analysis
- user interaction
yes - max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MasonClientt protected.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
MasonClientt protected.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target MasonClientt protected.exe
- Size 293KB
- Sample260728-fb2ntayble
- SHA256 bcbf95ec324a6721f7349ad267a29f00445994fe73c9e6f21638ddb49433cc2b
- MD5 8ffdea07e3a2297cc6bdeb98603a666c
- SHA1 c5db66a2c5a7aba20c8eb20a850b888e90eacd9e
- SHA512 37faa5a1180de10ba1c8116c50c789ce53f58fe809bc98300ebad368f06b4e07337a27a4b9809731ce2a70b38a57074d6b659b65b23402a78c92cb7635aba6f1
- SSDEEP 6144:eBbPGvUMT0+iFKSLFE7tUr/5bTgVziHzZnSKrCbYMxLbQ89q:WPgUMT0+aLF8tq/5/gVziHlBrCbYp8k
- TLSH T145548C67F6A000FBD4BA41358D636B02B7B2F03617219BFB1B94495D3F637A05D29BA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Mutex
-
yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا
Attributes
-
Install_directory
%Port%
-
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe
aes.plain
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/460-591-0x000001A91D0D0000-0x000001A91D0DE000-memory.dmp family_xworm - Detects DonutLoader 1 IoCs
resource yara_rule behavioral1/memory/4532-99-0x00000000001E0000-0x00000000001FC000-memory.dmp family_donutloader - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation MasonClientt protected.exe - Executes dropped EXE 2 IoCs
pid Process 3768 lohzutei.5ue.exe 4532 fxlmgvmc.ixf.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx svchost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 wmiprvse.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D lsass.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlmgvmc.ixf.exe - Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service wmiprvse.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 mousocoreworker.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC\Data = "ct%3D1785213782%26hashalg%3DSHA256%26bver%3D24%26appid%3DDefault%26da%3D%253CEncryptedData%2520xmlns%253D%2522http://www.w3.org/2001/04/xmlenc%2523%2522%2520Id%253D%2522devicesoftware%2522%2520Type%253D%2522http://www.w3.org/2001/04/xmlenc%2523Element%2522%253E%253CEncryptionMethod%2520Algorithm%253D%2522http://www.w3.org/2001/04/xmlenc%2523tripledes-cbc%2522%253E%253C/EncryptionMethod%253E%253Cds:KeyInfo%2520xmlns:ds%253D%2522http://www.w3.org/2000/09/xmldsig%2523%2522%253E%253Cds:KeyName%253Ehttp://Passport.NET/STS%253C/ds:KeyName%253E%253C/ds:KeyInfo%253E%253CCipherData%253E%253CCipherValue%253EM.C558_BAY.0.D.MsaArtifacts.CgEYrYY6koF6JV8oIbacGl6zgiYIpPhYkLSW47rviw05L8hELXPzqYh/fdXfLW0ni771uraZkZn7wgU/lVWrTt0H2J9Gs9sW7H8eRPan43u%252BeCFAouNKQNFewQgAOzQYi0QeNz3z0RzslRBU%252BlEiUr9d9%252Bb2iTFm0%252BnBz0jdq96077ADTZWcka/y10D07rkYjwMmqFbjlLPW02dlI%252BTYEWp1MCyZSf4WO25oK9olhYwGt%252B%252BvjWZyrp6rlIUa8neAFDYlnyQM1xniF%252Bs8dzbwhp22wA4suJGXVzUvHivYmSBsLOpATWiHX47om6vofz1OkbJvyvgemnrs6ndvHmmX9SlsXc7catYTFN0inX4C4IscXr%252BvfnvGAhT1Zm/mAXJBD2Wq%252BLZ1h2a1I6Zl%252B2xN%252BfDmQ%252BzH/0RFtCcWKS6EZvlgjSzj%252B92qHSU1REcmYnt/eM9Sya44W/qaFszRwIZLqNNhYrp2hpf9T09qFHmw/nlJ4KkCs/5yS%252B6plyO38bXvjJgb4WnpilmpUae0elx1TQ4%253D%253C/CipherValue%253E%253C/CipherData%253E%253C/EncryptedData%253E%26nonce%3DBEw6YdfbsNvY8uuyunrvF%252BbKVspCFJcR%26hash%3D%252BkocOK9NjXStEqyGa8qsJDWLZKGDw9L%252BNN26Ct3SjnQ%253D%26dd%3D1; path=/; domain=login.live.com; secure; httponly" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02jjadvltgstmjnq\DeviceId = "<Data LastUpdatedTime=\"1785213780\"><User username=\"02JJADVLTGSTMJNQ\"><HardwareInfo BoundTime=\"1785213782\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\DeviceLicenseUpdateFailureCount = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02jjadvltgstmjnq\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC\Flags = "8256" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02jjadvltgstmjnq\DeviceId = "<Data LastUpdatedTime=\"1785213780\"><User username=\"02JJADVLTGSTMJNQ\"><HardwareInfo BoundTime=\"1785213780\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC\Name = "DIDC" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "00184018735BF0BA" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC\P3P = "CP=\"CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOCi CNT\"" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-668679576-120646659-2289335452-1000\02bulcjdprjzqquz\Reason = "2147780641" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1785213803" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-668679576-120646659-2289335452-1000\02igqxzanagrkunc\DeviceId = "<Data><User username=\"02IGQXZANAGRKUNC\"><HardwareInfo BoundTime=\"1785213803\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-668679576-120646659-2289335452-1000\02igqxzanagrkunc\DeviceId = "<Data><User username=\"02IGQXZANAGRKUNC\"><HardwareInfo BoundTime=\"1785213806\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={B8AD69C8-1FD8-4364-B0CC-80641D91DC37}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-668679576-120646659-2289335452-1000\02igqxzanagrkunc\DeviceId = "<Data><User username=\"02IGQXZANAGRKUNC\"><HardwareInfo BoundTime=\"1785213805\" TpmKeyStateClient=\"0\" TpmKeyStateServer=\"0\" LicenseInstallError=\"0\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property mousocoreworker.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-668679576-120646659-2289335452-1000\ValidDeviceId svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110988,7153487,507286179,41816131,7202265,577889346,5804129,17110992,7202269,41484365,24262478,9179409,17962391,508368333,17962392,25036127,24262477,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,504928405,504928410" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-668679576-120646659-2289335452-1000\02igqxzanagrkunc\DeviceId = "<Data><User username=\"02IGQXZANAGRKUNC\"/></Data>\r\n" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000063c1dd56afbb7f4680699b82a2d5fb5400000000020000000000106600000001000020000000028350ed95ff0fd711b76f1c91badf22503d8a966476173184de1204caaed3b9000000000e800000000200002000000005b1fb8acfabe47db4e687277c45f2681dd04a4ed9fd91654d29fa630d2401a0000c0000d7d9553c4601a06a93970cbb634d8f7d1646feba30c562859e03ac4159829c67b97cc6efdb4284f2a91b576a45f726cf11cb20ec15af2240802dbfc33205044ddc2bfeed2314c36a19e914b7c2db15656f505a74d7b703d6fe854b482e7a494dffa2c3069a95ab3ab912d78ea10ad18d93e8b2a65656ac7e4390a6d5aa29b5ed501b4219ed78b9f65a01c1357c84b5ff107709938d11b788faeb236e489a79388df84cbf12a177b8d1e2137b3b1e37d5da54416f197598f09cb13418dee2d81d0393546834a0f20b9ea17dcd11c39ef5e4ce15bdbf1cc34d638a2ce66cba263f7e2ac6e80714149c3154dbf2ade83515a1aa1d7249081d3977e9775948a02c5a5a383bf02c5913862e4f344c27e0b47575771b7e898ae84894f5fbd8b5d7dacc69ba104ca400fbfac30e1aac821254c53207b49c6e4ecc8beae4910874358ae831f44ef6a3b7bde1158dfb4818f3da643798870f871e4f3333d4f23b15cc2f47ecce9581cc6c9d66951e82ecf1f2b582d1f26adb6e74409b9c4515d615f10e4381fac126b9ba7805996d50a10fc4ef7ee4d2bf33b9a0ca33a72d0a6bd133aef498ca0c36196cdfe73d2c37d85a79f166ff2e8cfb8c93d824abca08541c5298c0099692a4dc46cf37b289e62148bf8bb974af228f5190ae53494ea986cf714afb364608ae4300da106a60ba6233f7b0c928212b12e9df1a0a5b6df42e8e547abd40f6bd2ef3ffdfa8515e63e9f9dc49565d32f016e25058fff3fe81c8ddb36b0e836b4e8b3c84343b5309ad3c1fd8a7c5573aa538205e751c8caf452475ed4419a43b7b40fc466fd686e24a9a06c2cfcaf948fb007dbe333a769681d0dfadb95333b5a719c2652784cd1c4d717efd64e4a421e2a99e9c6bc6f71cd77af2e84831f047259c3873b161f055e81223e66126621d8168c4ee81bd1d6de9de12c52a0b2e8b1284cae527aa5ad53ec1a85776b11936e38864c38fb9de68c41bdc674d1bf0a87591a0b9424c578d15d99b87d2c01d158b2f8874a1d6895b237a9787b323e184dcdde928e1fb59c0951bf53a31305fcb6d4360220cc9b1b9eb4e81a120b13c378db292803023add2aff3fff00b3f20dd672de24ea012fcac04e32b39f400c35e516a703ed62a9295a0c3a691cf33ae0565b04fbbc81b277f877158deb9d66dfa7bde73944e99fd5425b9224e842521d51c54a7dbde36cf2a968c978ef2ed159ac763b30f32bb37b482537f4afe9cc7b12039c6e7b8bb3c57b90bb47b8a0e5024a189d7b96f09110fb5f87c03e758aed28ebf98f3011aa039a10332c989fb00696e0a5d576cc08267444e7d8ba05a3b849d85c6a8454030f109f5d8e3816ee62fc1f39844f6996657a2e7590934d13425e04a723a499290559867a4a3d7b201937ca7b985beef1951ec4a266e5075a82bbfc9256c71e6ba87c43f53b250e1e3c05efea7b204ec75535cf198ab88498b3755314ee19f360fc4d5262fb9df42466f611456861a11a256921c48f4a7475c26eb1dbe51b1cc93fcb66463fa5bf72245b23ac4ca4285cf1bfdb23b9e81801d70d80c8f1174027ad54040a3e53690422227891a7946f160661fd0c30ceae6618f4c2f3e6c0ce6699fffa11c38cd9d35e999a4d2666f46a18f1dcc4f79a0ae3acabf47d349f2061abd6fa62abcd55b92c80e0d3224ceba2c0355939f140e726271cb2578b69266e3167fcde2663dc7b57e00c4517a04669e153ae8951af708403c52b43895475880771816dc45c4bf0c0e14b6f1c1631cef8ca9ddae4d84797fc0d879c621283e060be6dcb8b7b7032dd1a3bc69cb4c95892c923c73f1325ad066938839db726dc5d1d7582eef7e8bba83d812bff41e156b209b05eed766efd3bf104ecd15997d982c5570ebcb6a972d1ae866bfee4e115cf518e05be8ba71f120621bad2cd5c2a2693d238016c29416121a5f5a1e39558c2be9f73382b09608b78d763628c0073dd85d2fb6a02863b48114c7ec31188a8d6fd71bb7e9d117de48704c1de751f1b32f56b663292f03a8165ad3b031e292192fb1c0a8faafb287ff7c97fbc70c4121a3e033cf3a969ff245ad8cb98e32dedee48d006f99a545b6f22061d052362d1ad4383e305bf6fc27a34dade4c94ae6565fc73157615e0d004567e8627df08dbed5fd25fece71fca0a41582347967731bf87273df2d398adba09201e2a43a12b2e33ec275ecf734e8822d9be47f70be516d600231475c65c5fea6d132d37125963c77ecb09d926f896f7d51da26238a962cef09dd3cf4fe368499311d5a9a795c7e4d22349ea4428982c5a95a711e934c450ee478ec448bd21ef87287010a6613d6588f31783667393f8589ae26b070bbd02686b2bbc5aa4c9b5e037290e24808533dba68c28ec04164650facb1095959af013e2e3aea6893de3f84c1fd629ac412753ad585e92fafea75f02c552192298c10821b64113224873d8cc28a40c6478d6fed4088b436bdc0346f8a4dd03ae147bdb15704a8163055b88ab7ebbab8408a910841fa9c75fd4b1b68e1b5f77edad828c378a39a572d263dfbafb17e9e604e07ae88f93408a15b5f0556d90076d496e6c43f4ed7fc203e2236a803882e8dcc07528bb574f2a51813e5325b9e6b4a42cee16208757718e0dd1b03f783c4b841a7cf7c0095b93a8097c057dfeb35dfb29ff5c7eb8f34232a0e29d73c4c8bf6417a254e540a6d22685ecdae3f8bf2847c82660e65546910591868a414f5f9e3af1797a728835d960f288f897f669ffb77dc7337d3c974174216148d96247d13a2a4e0680d2f6615691f17823c57ebb06e375a3e827f5e30fbec3a834bbcb47a88be638a5739706be02f6a9a64aa72c245aab889b79d4bb5a8160dc42f7b893b36e3cd95bfcfb0274731298b003fcfe364305797cbeb8555235279d8f80f24126ce4ba0ca2c41e61564ac37a0dc5ce86e8cc8a7eb9bef6502846ff85f15b5557183debfc45d67f199aa1bdbe5b2913c3b68df9b49569105f454aea383da06b792c9768a3a405a037a30487fe807bc46f53dbaf34ed641f6aaa0fdb6e7e8cc1bf3d0cb45ff400c7ac1ffa64d1eb9202d8ec2d27bcfed10098a2e7bd1046e3b176169dadf13eba7755d680604f43b150b728c4dbdbd9c76037dfb2d52791456988c68573c235eb7f726a77ce8c66e2e27d547bf6e7449aad4f06be4e0946646bd64042534b43915fc1b04664230ab8c1414e9fc4bb6de039727ef9113a059817a6cdbde00720e7cbfa70e0abbc51e14875d643a59675144dec45dae933113aa0c81ca2ec51ade9a6305ec4bd451b4e6d5b7e8d0ed8d296cdfb1afa6c614b0c679cb3cfac948058e50e172c3c0fb0f1b64d81a5075e4d72bb4eae6628836949f97ef66883343b17d99695cd24b1ab022031cfcbf7d2c5d6e317e002df638094e9022124ae017e9c45a503531c155aea1b275983b801207c7dfa8c15e105f77202e96a167fb2e94bd5987d52886daed9bef846a46b586c9dfe743252cdaf49e832b2360db17f68ec5d65133dc849613f09cb254eccac2340030312b0ac1779ae0ccde82e0f7753a694a326db404faf90fa437cb6c9fcb688f712e13c5806aa7a35a3dabea7f1caf42f425ea0cf40800c80ac70c06a8530df96a3ed4d577bc29d8829ef8b372e0bc7fa00f44c640480ea53767d0d0d4fed7c6144540d48b95415a0f822d56d2e6ed94717f48e5ad6d2912f5a591881ecb2ce2deb009d213d8b2919543ee761186197db8a3208470f57936081bb025e2f8becdc1b1baf9395ca89d79d976967b945a27577910005e4248616dc5018fbdd04bb37e3b5d055611cbde9a835abdb92f03da93c6b64a7c9302433bacc961a7293b9b89d2cee0d3ba0a5cd60da9c1f9a0461b516193b51d32375e7118f948847ddacaaf3032b1f0380f58c6759a3ea2281634b5004d81caea2b1ea2e212941fa8e5a8a2784f29da588cbccf9109961b66df1c3c790a2eea5048c0c51a798ae7270af42d8c4523f10f6a9998b1917901888d3b3bd84ddc70c6d52735861753adb41c635db610dfa1ca87a5b9824286a348656237c95461939d9bc2f89e38db325b11d08bee6781cda9faf8e7588beb5ca323a09ab5ede02679c4e8f2e4af66c080287c64dc7eba6580d8d733b4242b91dd2f07426213226945cec641c22a9b89384ef573a85a5699e1e0580a8ae42110463082f48c1a4abc08a145d76fe91f0aa0d11e011ff99ccd629d3889e44f8900c4db492c510561ff6c04513fc7f2659e05ef0a5e8a663d5944c49fd739f030f53b7f17e28606f49a44d8ec49741b1320c777fa8b81b04358ec6fc2f4cf3ce7aef48f9e8400000000cc0a14deca1c5d07c1c6a17bccdc00366b2ccde97d559701df0ca0f6c5e6fd20b97413bbe0475ca7adaf4f7109a35e525779b2495128178db03d32146cf9fba mousocoreworker.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02vnjevqcdpcdmni\Reason = "2147750679" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02bulcjdprjzqquz\Request Tuesday, July 28, 2026 05:43:02 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+wAAAAACAAAAAAAQZgAAAAEAACAAAADy0hWrs4VthoeNBPHJRIBjT3oPD8jrL8qvYeeXauv+hQAAAAAOgAAAAAIAACAAAADIAMvzFQHop5tba98wtE5fjIghsLThcPMTGTJzuNkY4sASAADjRdpov4IuxN1bVuBthso3cncdLH1zbCkyII5OfK26Z6i/eyRIWlT2IYiNMtxxvQmjpK4fHcff+jY8DDbuOzspZkz1b6851tBLSi41ubQjZy0Hd67V0N+FJ0lc8eFMAG0IZk2ZVBtn8StrpcOhkaCnl4Gfe6Mt0g4NykgjCJ1qshvHt1ndf88VS3PPET2GcaZV1KzPd7jes6CggKvW0YbcE667r+d00MGaxoWYs1EepJvDY1ChoQFjqmUxXwd+0V7/7Z1Je1/cmhMxrftYAyjn80WcVVgtxj/f/GwFBG3/ZIX/MlYSI3ABYHsvggeKF79aj7ikegNBgF1aRJsJtdIXQKAJ0REefBUtDPx+KeEdqxtcjR0xigNGvehBLYVphcaaYUYXnzVQCWHFF4e14Wi7bqPhK/iP0L0CbdMkutFU+hxV2EPeFmGFSvczlSdqOHeBWPL5ti+GXHWJ6wHbBZlvU8xWgsy8qnCNF9nK5kRod+mgwvg25ti71nC3X1DaOLRqUs5Z9Bf+d11PwDmcdcJ2u8Fl0l7GLZ+X3unAe8nVHuk2Y6mRjnvO5sEvSu8PQ08iWiE1plW7ia31ta42B2/qGYavx8dRpRXUipukpvPWMM0HlMtHEbT2lIjeApds+SAAcuV9dlAs0jH3rXvCqXy0WZVLvLXLxE1KDshNKcc9jy70eekywtamvGiDGbk4BP+dUHxBSL0ugTxdZQHyDtslaIS62k/3K9T9W9vIUDGq2jkmIWnzmxL3gvRTNcgEiqS02L2jfRNRX9l9YoWHTglS+S+xK5RPUyIbGDj/AGBGvpJMKJxDz7pa0iE8fHWGwgLHM623ajRBK7gcLoN3YFN/6QZAQJK/wWLME/3+XrbdC1SaRGcK1Uo6McpP5cxSnY1b34LTt5THK1QuDBbNgTbpni6cXutHYgVEASpNpCNlyj2DNLlMYunPz7603/q9uUv+6J2nFLnihXMzMz1croS/JOWEAWy3/uPhoFOskzqdLNfQaVi9vTj1YpYZpk0WXM5pjtw6b2Tgt0o4eMDIEOlBop8gpEz4+UiE0gMOKRZ3ZufcvKIipvNCeMbZCscb+Mb2/AA75jcljhAMw0nsB46HAoc0geR6M7wc8eofiBUTImCfwXl0JaYQC98IQKpboSXQ11YQ+1orJqvWTWqklL4zzi7LeiEMygFdwudOoSIXSpgfSFBjNvyi56RWtY9wTYtkhMt7EvZYaouHzV5grz+IU5W2CAl8NLcDrciRsiS7HXvws5gryRxZ61ytAaKozqh3RKo+H4nPClIw7xlyMX7NzRnLuVVd9ugsvtSHk2pTBUPUJPQ/h/96AI0RVFYMpUlWGJSDUChfs0kK5Yb8o3hI/y0q9UGB/sXSU4yKga5CEArjuqcvGRkN1YMfaZX2l3YLwh7tZUdgc/GZBjsqRPITN2Gl++Gy8LLs4fnQ1ZsfyUb+68TdN9/igrxal5j8MrZblU6fkQgyLCzQkA/QYXpb+VlNHWIshc9++ibWtvtNMIYVnpoWy532IhDrnZJQI/G8ylvohRKp44TipeEJE6TMwOBSf4S/CeCAKuEDACaGKWXTt8FCLVkIo3c/k4QqsNO15CRTsG9SsqB353B4jDzl0jiQEQFef3XVvirZKxiMjJs6iRCcKQCmwd7nqHKrJxga3xF7L3yL9FqRa4WqUPAE/a/YsoO379dGRGo3WmdnhvtD7TKTFjsrZRseBBRNp0IiPxGBGS6p8JCLWo/PQGKzRfiplx2BL4TyLMOeKzcfF/purIQ7WSol7t6OAf+FEsc6gGZfsN8iKM0SKl95Sg++FEQ9KcD7Bq5yNQkYerkAf9jqTicuShay901aqb0Ou5PKF022EHQN3QWlC6dYlNTJW/6ikceLmdYOPoBJcj40dme0XIZTMZPEsgRus42y7bSiXE3Inh2sz9LFhU3LlwnQ6Eqx2LjjnIXWtvJlNVIOQ0sJn//Ejy4bC6TyTTHrOORFrqMV0P1M1rzGJt7zh3hLWsNM9A9bJ+pRJ/zV9jt06cU1IfJoy0MAjXNoYOOoJcco+dbx8mH0DZdh4qqh6U+GIVJ7p4niXko+cbE7C3ZlcZiR57uKJnDrYvY1NRVATqlZzGtKWme7RlSEku+3M7O+iaPL1YUOGJanCmUF85BOitDegWwmFdPOBogguW7eSqVQVkWd4QnHS/1Hyxd07Tvhe4uOAn38iWkfH1MRCQklIlbzFOKQ8kXBNeIpXdWEyhrVV7PT/WNDeK7ldPw5ixn8rvTP1njNWUM2a0Y1+l3s4wma7t/puD1wlV6kNERsx3cjnBGi0QCjXmqeGbe82xFOYZpv5wdA3I1DMV2N5eoYheNtcA0DyTDiT/fJS+i+zRKWhNX1gw9loNJhG4cMdD1Nl+/n09NEhA3thaOBhT6fjJGE5X/4LCmttEHUC382ZnW2rIjYl14xEZc/BpEwP/m6oT1q0OqmDwtzM1f6y/qjao6MeFE/Yt+KGkwMOkfvXSGO5BuB0z/wUsng0GIEB9H3/ovF/jlUJvyeqYieHTNkVOMdSyAd1+Ws72yu2AqZzplatEWOtNHwdCcYRqMSFni0W+o3XnY4oLcjaPp5CWl+wACWamA5Tn68D8VOOujm7vuNAux350+5YCDaxrDXjbtzvJ695Xz8jPyc0cp4jdM33xLSwMrDaSswUacJ//TIbXbrHF0LrWC8baasy0lAVG3XwxzHGF9oXDmVkU7WxQZc1JcA+IsZfbNjaxsBvTSe+fyOto2gRgjT+gt1JxQVd8+swg6+R5Ju/8C+u2l86LDVKgTV8yLy2mUeu09uAPm+eo15r7WfpAzV60lU4wPO5kk7mZ3QsWFFVW/zjOOvOrzLIJV2tQOe1/5L1RvJt0dN5cIeljzIvHvADCLqkRu9oi4pwZvB6TWCCWcTlPD8D6/7KcsCQ1ycvQmFTiwhBTkCpDphO4E0+GS1/pvPiMWk4HvFvtJc7m0cJ9Z9X2fHqFFo1FQbNd7PF90OyJ0K3hqHaiAKFDy6dmTe0rTtGmaRbZd3HCjuzqnPrW6UmSF25gI+aTVVHrsmGtAJCnK10I29VG9kSmMhMcXWUcJPiAwZGuh4SE6Aq4ujbf7NnbPK5JOT/LRioEtZ6XFWrj6BGYpFYhJEqAMzIRb+eHsu7XTyUQfeXUdcFUVAJAjEDCbcdVoJ1b4Kd7qy+QrpqeOF3jQQgZ1TqPSR/8eFBu1Vl8dW4Yx9MuJUo3w8U+JK7xWdAjneGglxUbTYlZsjO2lefY1Ntekg2670vyqa6w1N3utoUATpGodTE4jlHtf0RtpMkhUPsvzFLjuQDdiqXZ9ptatX1slGv39ZUYb2PokEq6tToUHos4ffYQWBUaIyGvVozVPIPYoq9to2pyZXZM9Wh0vJmiUwrzKhlcVVmq5O1ZUGSijY1KaAO61ypVWeKl59X2x+Q/mInosBPhgZ9Ep4RTiHV35bl7lpTwbrGi7FIgZUaR9GK2rroKsQGl9EtOZMvbHdZu4qI9izKSakiDipr3AU03AbadElcG41xiQWtRWFypn0VnAQ9IUQR90i0duVhpj8q/kKIruRZm9fz0SgLd1zUWW9tIzMiT6SUeRNwZeEpaG5DY652ImICJTixAams+lcM+ucOS9fpgxwJKWE+PIzz3aTnNttqjy76lf//wJ3Ckw514VZYl0f0eSbt7q6rXKptgSsYB6jK3Cu0oBPE3FEjlxduTnzr+uSCtI7f19PeT+bN2KtgqHUNmwiz0Urf+VbYUUta506i9OmMi+9ECyrp9YTm5bcDJwc/Cgf5dnpwbJTWDouZAEgKULR6rZb6qh75tNIH8aSGVdWEqiT5LiRPmJ+/LP8GH4UpEJkV4YWB5YSFp+3Qz9SfPk5ZFAXbS2wFYpZqdyphYBtEdX+OTRW8ALjiuAKmVyulIfOo/XsZQupX+70nLUktfELHzHC5F/DYQHL+qZFDA/fYz/UwTAvO5F/GgMuPwuipyRPJYahHlNFn6P1LKADeC+V7g5UcR13I24Z+OSosCEzbgOgsLB/YlYiqjMEANjqQbfCpoby8MC9JGlN5Hzf/jSzWXVy9o1NT8Xvo3dXFMWHWykFQTUEpsHAd3WWGOd9BQY9lJSEklokHNnLgiRTSNTOneRFuOS43VJcABf/a0R/aqaFInVTUUE42jLwQMJ4kClkLVfRdXdwXuAvxNGTfaU4iMr/G/WhUTQkHpPLKc9wD7nbz+iUwiIaLKhv9kYfwvRObbRERCl93z/PxdPYV93C0bmRp9NKqioYU/vS4PJVoodIzS8LuMvvELRtCRigY7niA+kVwiSn0bwuC9KRi/3pH+K3yoNyC4b7WDudCVPApqAhcbCGxRupI33jKVNYNkf4u8jY+1DLvEYwTb0M831ldkr6RaH8dlko0wy76CfWg8ohuOHVGuZb2Hc8bVE2Pf3Umm8d/9ELPwdCDDMGyBFOUPif2LTYur92MToexBlnEE0HbgLqZ9qpqJw8Rv62Fa+2tyFvQB1S1SeLrpdPteIq7YUepGgCNCRBEU4FpohQdh3W30iXwBDW4CP96UnkHMgTu9Age5seqbtaZKEfvcuRvPPSRge8OxwXogdSX4C3s1NW7TM2dwNTvp5nxn/EKp9zDNk1E+3M1etS1z4vFf6YyCvnHhI6xyA7yhCKQu7j4Gu0odyRSKqHSmhikZsQSOtHDb6gtAqK2Vi7rc5H1Awzrc6QVIv+v8pr/Od71f5DUbA48P+gk9Odlt0RcW2n+y2JaxBDMM07TGoL3+okoAeZF/fYswPPmWZu7+vnosT7DGbSaPnfq7ZBguvC097ftu+oERjGuiC9c914IDrG9nklQreWGnoQf4EK2hsN4Y9R4S5ivhhbAi4gyB2HDl0JozR7FQJ/exXy1t9hlbA5Vh+VYbwTjc1UbfnNCT+GdBXo/LC1s2E9mnco9KDOdLpCZveuD6NTA9yOWZblWEfOdts7KrEMmqvasBBqlBPUOGvz726YSRA9zV8oiFYNvrqDauLOA9ayGQMy8Bu7mY8+8NTlLQabgNexvwvJ94XZqAwdigEdMaCHj61mFpuiRVYYGjSHAe11LoGoPV+QYB4UbaP4mwAxB5wJCP2iNq5JCgNVb7tEvMTlP2ZT8fEiMouI9y9I2P4Uzwzk7Z7ZsyJWAlgq60JfqCGaeJZvI5SbMBzFvRySU/Ys4GdFcMDY8iBDhbTnHsC9duYcrI8zuwfdqxRLofm370FgpymL70s2rNs3JQriKHyIpER1BLyOmsPmCyiys/0s7bi41FbDNZwAgOLoPF4Xf9py4o5vXhs497hjjyXYyiQpZJZu2UdZBrXqg8WTlxCDMDf23+8fzPhSCGwXtRwz1gUCJtLtk8CHWh/C0gmngVjBnGi6HfEla2GzsgK0abG7BZ2qEw0c5Pb6Ugwg6XUCtkiFiwYgEVRD0z9rAq8VeQeEXMqn7cIuyUPQgxOjlGMs9KOL0Y0+IbYeMJ1+NuH9nWo3P+WcMn4QFyX3Fz98//HKtvrYZb2isnHWl/1J0X/LBI5BEV60w8pvNACCRt4OQYdL9MKbNxMfMt3lMSAAx/XFDBGnK7rJzC8t9I9w/eDVvHjAb8l0pkL3oDfqy2lytR5O5UdC6da3LFYsU0iv2zFbdTb3tRFEkOiOGj28NXtV4R1BOkKP+SSfZ6uqD295PjYwjonsxO7zODFqR1QgTX6xvXTQNiCY3AmXTsO2fp5EiGczTiiZ8P/W+zwNLoQqHdLXStnaazF2KtFm/9s7HpjZ7USYy01kjsEAzW9zeXvx/DLErbkRKBN/6fpkth0jbDKcXh8hK+ekLQZxFa3yc4PgK1/GbeOOtJaJKpOLYxcrGyLvFgbTDwJCtQDa5dYCN4lQ66TQcI6+t2Bf7JG1FrlcdCg80ZSj2Iml2xY9xGCJl/fTIkcvmatRz844HITMTn9xpwCejkPPA4gBFq6Ur8SEFz1BiaIkd5FaAyE5V40Hf/wylQIjrqmrZJDwbcY/fjrGTX85afj3unEeZR4h0QR2sPQ6Sccfw9OO6jfC3MOPZYE94Dj0q87HVALb5X7iiEx+Y9mQIXc+A7IpYaplrABLYZmgCQddJvGyToKF/DUmvP+fFMnpR6qCvuagq8WL8ZIki1zWtV0FTE7Xlj4ti5eT4bknOkv4A6XXFurzg1Kd3+qkHb581MXhfuNnTlXfwZMvUk3DG3ZGVldtS9QP+JrrlY9+zbj+g+5y2WNv583zuY2OFDNHonKnPWVpQAFds+PC4J3Zdyolgv8U6idrQJWvX9x9InoS6qj3h7OVGQbWa+E/cOwOTq7xDV/fRvTNWQwZQMNHoBvIZ1oLp06LRQgQ73akFDMmta4BamCJurpqWh5TlJdzdrYW1wn+gLf4N4rxeWyZWU+sEsGUEovkm0Tkdi5AAAAAdwLHcYXJ4A5mGlg/uuY3+z6iLVXVeeRMjB1PR6ZCOj2BOAxUPD6+axgMI5oeJzRab8BldWONyV8eATlXjOK5mA==" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-668679576-120646659-2289335452-1000\02igqxzanagrkunc svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "00184018735BF0BA" mousocoreworker.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02jjadvltgstmjnq\DeviceId = "<Data LastUpdatedTime=\"1785213780\"><User username=\"02JJADVLTGSTMJNQ\"><HardwareInfo BoundTime=\"1785213783\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02jjadvltgstmjnq\DeviceId = "<Data LastUpdatedTime=\"1785213780\"><User username=\"02JJADVLTGSTMJNQ\"><HardwareInfo BoundTime=\"1785213781\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02bulcjdprjzqquz svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02bulcjdprjzqquz\Response Tuesday, July 28, 2026 05:43:02 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAqhp1A/rztkeavAxozqQU+wAAAAACAAAAAAAQZgAAAAEAACAAAACMqIO+hanGR1gxlSvZaTZ2LR4sf8lcbjpuQ++MkI333gAAAAAOgAAAAAIAACAAAADeSGynvPqWM1jLa3mRSlbB0chgMYY3ok090KzM7xfQEIAFAAA3wRgTsHM9cqeB0RxCrgsyvjH2EBbMn8GRHlnR7cTjFPxoxSxeOr3g99K5ejzFQuuQ6RUXhZa3UHdT+i+EeoPzI6EQpr9eb6XDIPrVdsqvIZqrF7/Xx7BuJ1DLPwVmQg3n6AKHADYHQlmGeWgtK8WrJ1zfhWHuDjsstWsiiZNgPpMs+U8QXq65/yKJShswetlur1D01bAkyhwA/MwMi5x1GuzgMMJd971mp6WVoO8qB7k4oDPO4pVepQPtojGMmzFkn2hxKmzBf5kUNNxSnJGLV4M2tD5t+BOP/056tpPmjgg8wKRQ14sW/sdthJM3vt4Y8q+iTv1f3gI2JxGeeSCBkWhbJyzqYnG9+QtWhWpl82V8o4jR9ju0CQ0SoiDnZl3QQMdPsFsgFi9b3X5W+H0t0hWX6yXbTyiHxJehHB302M1GDaoi/I8B3t+myqkj65ImW70/uLB53I+8cfZxlrKjLeH1Y4BTClroMU5g4FD6wpqsmtp0pPoBJ2ThXaOxyP6MLqUIhuSCIorslozrX62dOpjw6E45KraWmRLBX2DgoxmOBd2TzACm8XhuYbdlPfn//8gp8ht99Ms69JzZ3fcmhp05LLg5BUJPZowAu8goQCzWfuj0xdeHQuHmVgeDQuM9H1jh6UlE4eUD04hoFAjLPfrhay+/p9nKHu0uGtlISP5dmRgPN4AAoljvmPy2DCzV4D7uMD5PI4cEEp9sPtHpjyi2KE+jENb+6PQSG5/cpuJUoLcwKFqveNrKvGilb2bLyodqeyIWH+srTtQs7nTPlM9ZXtZQHD5ywc6n+IQnGOOysKqqFvf1sQ1nVThPdIlOiDw7MD5x55CMXsTsIY3CMzSuV8KsVc78X5dJElgGgC2YQZiQWS8zsnFg9C1LWx+e4ELiWzDwPfXlZqeY97szTTiyHDkHEfYCembiWPwA7dY2tUOfJl26Kw1DNFBaWiuSeS2qEuRilc+lPzJWaFVUQ3BrM5sUwbHPqGt82aDxT3f6i5jB2eAXMTioL2KoJJTYuqrGe6gxDiCNBkjUbYcRjkANVg1o/U4z3azZKf53KhnKIBi7+t9VdPSfpqShiHoXxC8hSPmrmsbXmFsfHIuwMDXC+nSXzlsJNWMheaodFh3dkWEVptuJqdCmJIzkec8nc/kpnX7WO+gOQxBBLoigSkgI7PGluJ2/0R2BBMLo/+xXneQ4Y/HiRyxB2MhkXtwFgdVuRScrcJTqNcIJ3Xa85HrQog5bp4KFtFUXFWNwfpk5wR+dZK7863ZDic40yOA0uRAinvlFsaUGB/jkzN4G4cbMgmuhTt0ylwC37ZlwegiaibgNmAiQUFe+hsWGFf4v+eeGMyxUHiDUnlUbkAilJ2iA9jc8fi2GIKotFiI6l1domutvAc5vewzw7DD4F/VVIjdi6E6YIRWronnvYBh4ap3R+VjndOyee3VbKIXtcZCPHxsZ/RJ4ccRSRNLWXsjW7fi1lnQebQULWMc29lbECJHBqPucE4BGhMGi6tVdy5OkHZGX3/PGvujZfDIQ6bnD6Wkf9rrxZhNku4B/hjT8FFrjX78RPKRNJ2aLQFYsDfbPwAbeAiZkCPXHQpCOpUImCd2+Vnp6MFQoIKIIWAsCklh32bBIk1lOPFknNExD8tBKIfYjD6p7bC4Vo3erXOldjGSp+Mgz1LG/t9WL8B1PIRXqmhbcmcUcsXNDSO7qI7v/R6Kht9g8uRAvMtmimo1WVXhgB+3QT9UdDT2DGX8FUETnm6eQMA2/EUNyh/83orm4CLQDi/Ss4jKKHCJ81ddHDVO8Yn9U7UxsigIcAsnKh3BOEUlBoi9j+P+Ad9NQD707NwiA0aneKCn5cnxyg+kU0DbossmPARn4t1fB2oBAQAAAAHq6Bres4GYrnJI2sHPsdTvtU1113X/bupffa6dY0Nv/6FKGomiwfUBJ04wUNCRr/4OmJWFj4WjCTugsdgWH1Pg=" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f2ed9c964b1edd01f2ed9c964b1edd01f2ed9c964b1edd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000fc5c65252000323732376261623435306232613833396363386532633734363735663533333365336538363535613337353030363531663139326338343935336239323939300000b20009000400efbefc5c6525fc5c65252e000000000000000000000000000000000000000000000000000e55a400320037003200370062006100620034003500300062003200610038003300390063006300380065003200630037003400360037003500660035003300330033006500330065003800360035003500610033003700350030003000360035003100660031003900320063003800340039003500330062003900320039003900300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000074efd5731000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32373237626162343530623261383339636338653263373436373566353333336533653836353561333735303036353166313932633834393533623932393930000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007469676d676f6c6d00000000000000007ce472585670434fb52dd3d67028ca2423b7ad23194ff111b995d2489d1a27687ce472585670434fb52dd3d67028ca2423b7ad23194ff111b995d2489d1a2768ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003600360038003600370039003500370036002d003100320030003600340036003600350039002d0032003200380039003300330035003400350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000499bfc0d000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000870291964b1edd01870291964b1edd01870291964b1edd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000fc5c65252000383266346661373763313561363666613638656537376530356335616666623039333530373336363161613663306165326630323666366462393462393735660000b20009000400efbefc5c6525fc5c65252e000000000000000000000000000000000000000000000000007940b000380032006600340066006100370037006300310035006100360036006600610036003800650065003700370065003000350063003500610066006600620030003900330035003000370033003600360031006100610036006300300061006500320066003000320036006600360064006200390034006200390037003500660000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000074efd5731000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38326634666137376331356136366661363865653737653035633561666662303933353037333636316161366330616532663032366636646239346239373566000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007469676d676f6c6d00000000000000007ce472585670434fb52dd3d67028ca2422b7ad23194ff111b995d2489d1a27687ce472585670434fb52dd3d67028ca2422b7ad23194ff111b995d2489d1a2768ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003600360038003600370039003500370036002d003100320030003600340036003600350039002d0032003200380039003300330035003400350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000499bfc0d000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000803cab964b1edd01803cab964b1edd01803cab964b1edd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000fc5c65252000656663363262393661333164636231383232373661346162383232373336623231373733383664613965353265626461316335333739323432333038376331390000b20009000400efbefc5c6525fc5c65252e0000000000000000000000000000000000000000000000000080069600650066006300360032006200390036006100330031006400630062003100380032003200370036006100340061006200380032003200370033003600620032003100370037003300380036006400610039006500350032006500620064006100310063003500330037003900320034003200330030003800370063003100390000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000074efd5731000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65666336326239366133316463623138323237366134616238323237333662323137373338366461396535326562646131633533373932343233303837633139000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007469676d676f6c6d00000000000000007ce472585670434fb52dd3d67028ca2427b7ad23194ff111b995d2489d1a27687ce472585670434fb52dd3d67028ca2427b7ad23194ff111b995d2489d1a2768ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003600360038003600370039003500370036002d003100320030003600340036003600350039002d0032003200380039003300330035003400350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000499bfc0d000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20f6d359-5895-4a9b-8 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e28bc050-eacc-425c-b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000000e15a4964b1edd010e15a4964b1edd010e15a4964b1edd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000fc5c65252000626165303266376533353630363565613537303030373932643932333135323131373664343234656336663934383162666130303734623232306437623230390000b20009000400efbefc5c6525fc5c65252e00000000000000000000000000000000000000000000000000f22d9d00620061006500300032006600370065003300350036003000360035006500610035003700300030003000370039003200640039003200330031003500320031003100370036006400340032003400650063003600660039003400380031006200660061003000300037003400620032003200300064003700620032003000390000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000074efd5731000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62616530326637653335363036356561353730303037393264393233313532313137366434323465633666393438316266613030373462323230643762323039000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007469676d676f6c6d00000000000000007ce472585670434fb52dd3d67028ca2425b7ad23194ff111b995d2489d1a27687ce472585670434fb52dd3d67028ca2425b7ad23194ff111b995d2489d1a2768ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003600360038003600370039003500370036002d003100320030003600340036003600350039002d0032003200380039003300330035003400350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000499bfc0d000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 = "\\\\?\\Volume{0DFC9B49-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\34bde80ce1c5de6adab0f030909ae57842fd25170d2dffbfb1e6c1b380849fbc" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6fdbe1e9-b012-49d1-b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 = 076395964b1edd01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 = "\\\\?\\Volume{0DFC9B49-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\82f4fa77c15a66fa68ee77e05c5affb0935073661aa6c0ae2f026f6db94b975f" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b = c01fa9964b1edd01 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 = "\\\\?\\Volume{0DFC9B49-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a51dcd61a26c9205147cd3b954b170d68c687860c2fb0913d04628f2fd287366" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a = 9218b2964b1edd01 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4cf0fda7-a759-48fe-a RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b RuntimeBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 = 425aac964b1edd01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000060daa8964b1edd0160daa8964b1edd0160daa8964b1edd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000fc5c65252000333462646538306365316335646536616461623066303330393039616535373834326664323531373064326466666266623165366331623338303834396662630000b20009000400efbefc5c6525fc5c65252e00000000000000000000000000000000000000000000000000a0689800330034006200640065003800300063006500310063003500640065003600610064006100620030006600300033003000390030003900610065003500370038003400320066006400320035003100370030006400320064006600660062006600620031006500360063003100620033003800300038003400390066006200630000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000074efd5731000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33346264653830636531633564653661646162306630333039303961653537383432666432353137306432646666626662316536633162333830383439666263000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007469676d676f6c6d00000000000000007ce472585670434fb52dd3d67028ca2426b7ad23194ff111b995d2489d1a27687ce472585670434fb52dd3d67028ca2426b7ad23194ff111b995d2489d1a2768ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003600360038003600370039003500370036002d003100320030003600340036003600350039002d0032003200380039003300330035003400350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000499bfc0d000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a = "\\\\?\\Volume{0DFC9B49-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\efc62b96a31dcb182276a4ab822736b2177386da9e52ebda1c53792423087c19" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000db509f964b1edd01db509f964b1edd01db509f964b1edd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000fc5c65252000613531646364363161323663393230353134376364336239353462313730643638633638373836306332666230393133643034363238663266643238373336360000b20009000400efbefc5c6525fc5c65252e0000000000000000000000000000000000000000000000000025f2a100610035003100640063006400360031006100320036006300390032003000350031003400370063006400330062003900350034006200310037003000640036003800630036003800370038003600300063003200660062003000390031003300640030003400360032003800660032006600640032003800370033003600360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000074efd5731000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61353164636436316132366339323035313437636433623935346231373064363863363837383630633266623039313364303436323866326664323837333636000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007469676d676f6c6d00000000000000007ce472585670434fb52dd3d67028ca2424b7ad23194ff111b995d2489d1a27687ce472585670434fb52dd3d67028ca2424b7ad23194ff111b995d2489d1a2768ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003600360038003600370039003500370036002d003100320030003600340036003600350039002d0032003200380039003300330035003400350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000499bfc0d000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24bdb587-4926-433f-9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\878953eb-e5a6-4ae2-b = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d86cc55b-190c-45ab-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f4a4915e-8c3d-46cb-a RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a3b436f5-a887-4d19-b RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9861efa-c3c0-4dfa-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a = "\\\\?\\Volume{0DFC9B49-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\2727bab450b2a839cc8e2c74675f5333e3e8655a37500651f192c84953b92990" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a = 93d2a0964b1edd01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af567e35-d9eb-4fb0-a RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07c2fc99-e292-4723-8 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b0ea736-3db4-4471-a RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 = 81eda4964b1edd01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3bc25601-bdb4-4ad9-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 4532 fxlmgvmc.ixf.exe 4532 fxlmgvmc.ixf.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe 3768 lohzutei.5ue.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3312 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 460 MasonClientt protected.exe Token: SeDebugPrivilege 3768 lohzutei.5ue.exe Token: SeShutdownPrivilege 3312 Explorer.EXE Token: SeCreatePagefilePrivilege 3312 Explorer.EXE Token: SeAuditPrivilege 2832 svchost.exe Token: SeShutdownPrivilege 3312 Explorer.EXE Token: SeCreatePagefilePrivilege 3312 Explorer.EXE Token: SeShutdownPrivilege 3312 Explorer.EXE Token: SeCreatePagefilePrivilege 3312 Explorer.EXE Token: SeShutdownPrivilege 4040 svchost.exe Token: SeCreatePagefilePrivilege 4040 svchost.exe Token: SeShutdownPrivilege 4040 svchost.exe Token: SeCreatePagefilePrivilege 4040 svchost.exe Token: SeShutdownPrivilege 4040 svchost.exe Token: SeCreatePagefilePrivilege 4040 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2188 svchost.exe Token: SeIncreaseQuotaPrivilege 2188 svchost.exe Token: SeSecurityPrivilege 2188 svchost.exe Token: SeTakeOwnershipPrivilege 2188 svchost.exe Token: SeLoadDriverPrivilege 2188 svchost.exe Token: SeBackupPrivilege 2188 svchost.exe Token: SeRestorePrivilege 2188 svchost.exe Token: SeShutdownPrivilege 2188 svchost.exe Token: SeSystemEnvironmentPrivilege 2188 svchost.exe Token: SeManageVolumePrivilege 2188 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2188 svchost.exe Token: SeIncreaseQuotaPrivilege 2188 svchost.exe Token: SeSecurityPrivilege 2188 svchost.exe Token: SeTakeOwnershipPrivilege 2188 svchost.exe Token: SeLoadDriverPrivilege 2188 svchost.exe Token: SeSystemtimePrivilege 2188 svchost.exe Token: SeBackupPrivilege 2188 svchost.exe Token: SeRestorePrivilege 2188 svchost.exe Token: SeShutdownPrivilege 2188 svchost.exe Token: SeSystemEnvironmentPrivilege 2188 svchost.exe Token: SeUndockPrivilege 2188 svchost.exe Token: SeManageVolumePrivilege 2188 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2188 svchost.exe Token: SeIncreaseQuotaPrivilege 2188 svchost.exe Token: SeSecurityPrivilege 2188 svchost.exe Token: SeTakeOwnershipPrivilege 2188 svchost.exe Token: SeLoadDriverPrivilege 2188 svchost.exe Token: SeSystemtimePrivilege 2188 svchost.exe Token: SeBackupPrivilege 2188 svchost.exe Token: SeRestorePrivilege 2188 svchost.exe Token: SeShutdownPrivilege 2188 svchost.exe Token: SeSystemEnvironmentPrivilege 2188 svchost.exe Token: SeUndockPrivilege 2188 svchost.exe Token: SeManageVolumePrivilege 2188 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2188 svchost.exe Token: SeIncreaseQuotaPrivilege 2188 svchost.exe Token: SeSecurityPrivilege 2188 svchost.exe Token: SeTakeOwnershipPrivilege 2188 svchost.exe Token: SeLoadDriverPrivilege 2188 svchost.exe Token: SeSystemtimePrivilege 2188 svchost.exe Token: SeBackupPrivilege 2188 svchost.exe Token: SeRestorePrivilege 2188 svchost.exe Token: SeShutdownPrivilege 2188 svchost.exe Token: SeSystemEnvironmentPrivilege 2188 svchost.exe Token: SeUndockPrivilege 2188 svchost.exe Token: SeManageVolumePrivilege 2188 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2188 svchost.exe Token: SeIncreaseQuotaPrivilege 2188 svchost.exe Token: SeSecurityPrivilege 2188 svchost.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE - Suspicious use of SendNotifyMessage 13 IoCs
pid Process 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE 3312 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3924 Conhost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 460 wrote to memory of 3768 460 MasonClientt protected.exe 86 PID 460 wrote to memory of 4532 460 MasonClientt protected.exe 87 PID 3768 wrote to memory of 616 3768 lohzutei.5ue.exe 5 PID 3768 wrote to memory of 684 3768 lohzutei.5ue.exe 7 PID 3768 wrote to memory of 880 3768 lohzutei.5ue.exe 11 PID 3768 wrote to memory of 1016 3768 lohzutei.5ue.exe 13 PID 3768 wrote to memory of 516 3768 lohzutei.5ue.exe 14 PID 3768 wrote to memory of 332 3768 lohzutei.5ue.exe 15 PID 3768 wrote to memory of 1088 3768 lohzutei.5ue.exe 16 PID 3768 wrote to memory of 1188 3768 lohzutei.5ue.exe 18 PID 3768 wrote to memory of 1204 3768 lohzutei.5ue.exe 19 PID 3768 wrote to memory of 1216 3768 lohzutei.5ue.exe 20 PID 3768 wrote to memory of 1232 3768 lohzutei.5ue.exe 21 PID 3768 wrote to memory of 1312 3768 lohzutei.5ue.exe 22 PID 3768 wrote to memory of 1364 3768 lohzutei.5ue.exe 23 PID 3768 wrote to memory of 1400 3768 lohzutei.5ue.exe 24 PID 3768 wrote to memory of 1440 3768 lohzutei.5ue.exe 25 PID 3768 wrote to memory of 1500 3768 lohzutei.5ue.exe 26 PID 3768 wrote to memory of 1660 3768 lohzutei.5ue.exe 27 PID 3768 wrote to memory of 1700 3768 lohzutei.5ue.exe 28 PID 3768 wrote to memory of 1716 3768 lohzutei.5ue.exe 29 PID 3768 wrote to memory of 1844 3768 lohzutei.5ue.exe 30 PID 3768 wrote to memory of 1880 3768 lohzutei.5ue.exe 31 PID 4532 wrote to memory of 3312 4532 fxlmgvmc.ixf.exe 56 PID 3768 wrote to memory of 1916 3768 lohzutei.5ue.exe 32 PID 3768 wrote to memory of 1964 3768 lohzutei.5ue.exe 33 PID 3768 wrote to memory of 1140 3768 lohzutei.5ue.exe 34 PID 3768 wrote to memory of 2024 3768 lohzutei.5ue.exe 35 PID 3768 wrote to memory of 2052 3768 lohzutei.5ue.exe 36 PID 3768 wrote to memory of 2156 3768 lohzutei.5ue.exe 37 PID 3768 wrote to memory of 2176 3768 lohzutei.5ue.exe 38 PID 3768 wrote to memory of 2188 3768 lohzutei.5ue.exe 39 PID 3768 wrote to memory of 2304 3768 lohzutei.5ue.exe 40 PID 3768 wrote to memory of 2396 3768 lohzutei.5ue.exe 42 PID 3768 wrote to memory of 2556 3768 lohzutei.5ue.exe 43 PID 3768 wrote to memory of 2640 3768 lohzutei.5ue.exe 44 PID 3768 wrote to memory of 2648 3768 lohzutei.5ue.exe 45 PID 3768 wrote to memory of 2800 3768 lohzutei.5ue.exe 46 PID 3768 wrote to memory of 2832 3768 lohzutei.5ue.exe 47 PID 3768 wrote to memory of 2844 3768 lohzutei.5ue.exe 48 PID 3768 wrote to memory of 2860 3768 lohzutei.5ue.exe 49 PID 3768 wrote to memory of 3000 3768 lohzutei.5ue.exe 50 PID 3768 wrote to memory of 3064 3768 lohzutei.5ue.exe 51 PID 3768 wrote to memory of 564 3768 lohzutei.5ue.exe 52 PID 3768 wrote to memory of 3156 3768 lohzutei.5ue.exe 54 PID 3768 wrote to memory of 3284 3768 lohzutei.5ue.exe 55 PID 3768 wrote to memory of 3312 3768 lohzutei.5ue.exe 56 PID 3768 wrote to memory of 3476 3768 lohzutei.5ue.exe 57 PID 3768 wrote to memory of 3660 3768 lohzutei.5ue.exe 58 PID 3768 wrote to memory of 3824 3768 lohzutei.5ue.exe 60 PID 3768 wrote to memory of 2224 3768 lohzutei.5ue.exe 62 PID 3768 wrote to memory of 4676 3768 lohzutei.5ue.exe 65 PID 3768 wrote to memory of 4776 3768 lohzutei.5ue.exe 66 PID 3768 wrote to memory of 4876 3768 lohzutei.5ue.exe 67 PID 3768 wrote to memory of 4872 3768 lohzutei.5ue.exe 69 PID 3768 wrote to memory of 4260 3768 lohzutei.5ue.exe 71 PID 3768 wrote to memory of 2464 3768 lohzutei.5ue.exe 72 PID 3768 wrote to memory of 2496 3768 lohzutei.5ue.exe 73 PID 3768 wrote to memory of 1792 3768 lohzutei.5ue.exe 74 PID 3768 wrote to memory of 3260 3768 lohzutei.5ue.exe 75 PID 3768 wrote to memory of 1432 3768 lohzutei.5ue.exe 76 PID 3768 wrote to memory of 5008 3768 lohzutei.5ue.exe 77 PID 3768 wrote to memory of 4392 3768 lohzutei.5ue.exe 79 PID 3768 wrote to memory of 4688 3768 lohzutei.5ue.exe 80 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:516
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
PID:684
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3424e661-062f-4f5a-8548-2f6425275b0e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f7668524-219f-42f3-b234-20c3f21e18d5 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-35e1c178-016a-455a-8d32-267a73e9257f -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d2cd6439-f449-41ef-bf1b-1e847221a460 -LifetimeId:25dcfde9-0f82-49d3-bc9a-e290fb8eee3c -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵PID:880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:1016
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:332
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1188 -
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:564
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:3400
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1216
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1232
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1400
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:3000
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:1440
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1844
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1880
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1964
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:2024
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2052
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2176
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2304
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2396
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:3156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3284
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\MasonClientt protected.exe"C:\Users\Admin\AppData\Local\Temp\MasonClientt protected.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\lohzutei.5ue.exe"C:\Users\Admin\AppData\Local\Temp\lohzutei.5ue.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
-
-
C:\Users\Admin\AppData\Local\Temp\fxlmgvmc.ixf.exe"C:\Users\Admin\AppData\Local\Temp\fxlmgvmc.ixf.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3476
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3660
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3824
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2224
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4776
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:4876
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:2464
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:2496
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1792
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3260
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:5008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:4688
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
PID:2580
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:3732
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 3027db9413fed5bee8ccf2011fb40bae D0mIQ11/EE+aik0/3E5kBQ.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:3716 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:3216
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:2620
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:3896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4900
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:3372
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
PID:3924
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵PID:1628
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵PID:5052
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\OneSettings\config.json
- Size 6KB
- SHA256 a798dead9cfb0ce27e67b6298c9cc85df87d4af6f0c865742a76a4cf5c208068
- MD5 5e1a01d6bf4e00ffeaf4e5531d0bec8e
- SHA1 48eea89c355a37371c53a598a7ca892c2194edf8
- SHA512 1dd0fdc05ea760ec9bd5c495bd32be3487dd52fc905322e272a009105782c2c1780714b51e54d62302d16a6893062120db0cbccbd5a4f7b271551f141b49af8c
- SSDEEP 192:nGDCctouMgRXUhWwpoTQ/eKIO2CE4cA1RdrPLjT:nG5touMgRXUhWwpoTQ/eKL2tXWRVPLjT
- TLSH T115E1750DB184C87E9FAB61E6644AB940C6687B27ADC44CE4E5C28D1ED45F74C711CBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 6e3e7bce6aa002461a1f994371a48de1c566af55ada7d1f8d954f2744cc27be3
- MD5 b3f80624d2bb62b74f55c30841ade1ea
- SHA1 818e9ac4ecefa898d25ac2a01bdc42aea00d540b
- SHA512 808ea529f426265f610fa61b90c0b2dec4c8494dbeb363889cd8a5a7ec48767071ed2300d6608506ac7495bac41d7ecb5042a2e6e66f60e0520329e605c2afcf
- TLSH T109E0C2517BA84604E9730A3CA973A544597B773BEE00DACD0775008C5C29F9199F7B29
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
- Size 412B
- SHA256 4bfe34d43ccfdc85f7142338cece50b08812673c20720cfca8353c928a528a1b
- MD5 ad5cfa677c223747cffcfec6514628c3
- SHA1 87f89fded11d829a7eebc704c84931746ff98132
- SHA512 743914dd32696df6f4d4c2b6656fa72b09f46c9b8710c7c20c1087af54723efc92fe1eec814c56377ffc661ebccda18a47d09f2ef9e17716f6d17cd5113eb52c
- TLSH T1A5E0C02425FB425CF5E8C03487E5656105EAF0250509B1B81AE07B00A306B00EC42D35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fxlmgvmc.ixf.exe
- Size 94KB
- SHA256 5463396182a2096147cc4d458d31483cad2c48b2ac51c0fb27b6fcdf2cea4fd1
- MD5 d3dbc586a8bcc6d52997e5b886bc13ff
- SHA1 b9d46e763339afadf171f5d1c7a511409156fcdb
- SHA512 e879f021f4675b75c28b734c3e0052a361c5e5837ca1798e81e4c33e136a8db37744ed903ca0cd5ef7cce95fdd02fd139690640d82c6959c08d2b592a243d1b1
- SSDEEP 1536:BK9gBiljOLbPGzDUxaBTdXO4HiwkXRlKSgTYcNunF39S2wEctnUbV:BK9gBiQPGvUMTd+4HiFKSi94Fw2wEctw
- TLSH T1DA93018A0550538BD46F3A7AD0E51B7773CF820B32F806BD6F84CB491963153796A4F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lohzutei.5ue.exe
- Size 161KB
- SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
- MD5 94f1ab3a068f83b32639579ec9c5d025
- SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
- SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
- SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
- TLSH T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- Size 2KB
- SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
- MD5 8abf2d6067c6f3191a015f84aa9b6efe
- SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
- SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
- TLSH T1A451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- Size 2KB
- SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
- MD5 f313c5b4f95605026428425586317353
- SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
- SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
- TLSH T1D451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
- MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
- SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
- SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
- TLSH T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
- MD5 7d612892b20e70250dbd00d0cdd4f09b
- SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
- SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
- TLSH T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
- MD5 0b990e24f1e839462c0ac35fef1d119e
- SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
- SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
- TLSH T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH