Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 17:37
Behavioral task
behavioral1
Sample
2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
General
- Target 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 376KB
- Sample261001-v7mxvswzcx
- SHA256 679c2f04992033c40f369510803be182398d72986e5ebb59da797da6aed5e93b
- MD5 2024cdab99af677c0b34660597acaff2
- SHA1 ca60603f8e452e49fee3e4fcb95b3a2b926cc75f
- SHA512 9b856df06fdf823449d05e181836bf418e71ed2548047646cbddbbbb567ff1eb47f2d4506671c435167a421b970f3287079aace63a186d113d5e95d94be26a6c
- SSDEEP 6144:EJebwX9wz4ZoeETEW1gbpJA3KpSL0pDSNiKbh:EJebW9ULePJA3KY0p6i2
- TLSH T1BF845B43BBD100BAE5BE463844735619A73AF8114B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sheetrat Payload 5 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral1/memory/4284-0-0x000002449F220000-0x000002449F282000-memory.dmp family_sheetrat_v1 behavioral1/memory/3356-241-0x0000026DE3D10000-0x0000026DE3D72000-memory.dmp family_sheetrat_v1 behavioral1/files/0x00080000000245a3-253.dat family_sheetrat_v1 behavioral1/memory/1772-442-0x000001F73E030000-0x000001F73E092000-memory.dmp family_sheetrat_v1 behavioral1/memory/1660-588-0x0000021741930000-0x0000021741992000-memory.dmp family_sheetrat_v1 - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\MalwareDefenderW3eb32.exe," 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" BootExecutor.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" MalwareDefenderW3eb32.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe - UAC bypass 3 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" MalwareDefenderW3eb32.exe - Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 5 IoCs
resource yara_rule behavioral1/memory/4284-0-0x000002449F220000-0x000002449F282000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/3356-241-0x0000026DE3D10000-0x0000026DE3D72000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/files/0x00080000000245a3-253.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/1772-442-0x000001F73E030000-0x000001F73E092000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/1660-588-0x0000021741930000-0x0000021741992000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL - Detects executables (downlaoders) containing URLs to raw contents of a paste 5 IoCs
resource yara_rule behavioral1/memory/4284-0-0x000002449F220000-0x000002449F282000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral1/memory/3356-241-0x0000026DE3D10000-0x0000026DE3D72000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral1/files/0x00080000000245a3-253.dat INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral1/memory/1772-442-0x000001F73E030000-0x000001F73E092000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral1/memory/1660-588-0x0000021741930000-0x0000021741992000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 5 IoCs
resource yara_rule behavioral1/memory/4284-0-0x000002449F220000-0x000002449F282000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/3356-241-0x0000026DE3D10000-0x0000026DE3D72000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x00080000000245a3-253.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/1772-442-0x000001F73E030000-0x000001F73E092000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/1660-588-0x0000021741930000-0x0000021741992000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" Process not Found - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Process not Found - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe - Executes dropped EXE 39 IoCs
pid Process 3268 Process not Found 584 Process not Found 776 Process not Found 4560 Process not Found 2204 Process not Found 772 Process not Found 2344 Process not Found 1552 Process not Found 1152 Process not Found 2332 Process not Found 1736 Process not Found 4456 Process not Found 664 Process not Found 1128 Process not Found 1112 Process not Found 2472 Process not Found 3660 Process not Found 1300 Process not Found 676 Process not Found 1676 Process not Found 2656 Process not Found 2064 Process not Found 4620 Process not Found 2648 Process not Found 1268 Process not Found 2468 Process not Found 4068 Process not Found 2624 Process not Found 856 Process not Found 1624 Process not Found 3404 Process not Found 3004 Process not Found 1008 Process not Found 3756 Process not Found 1784 Process not Found 2564 Process not Found 3356 MalwareDefenderW3eb32.exe 1772 BootExecutor.exe 1660 MalwareDefenderW3eb32.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Process not Found - Loads dropped DLL 64 IoCs
pid Process 4688 Process not Found 3108 Process not Found 2816 Process not Found 1628 Process not Found 2740 Process not Found 4368 Process not Found 3252 Process not Found 3952 Process not Found 3356 MalwareDefenderW3eb32.exe 3824 CMD.exe 584 Process not Found 2740 Process not Found 3268 Process not Found 4560 Process not Found 664 Process not Found 776 Process not Found 2204 Process not Found 772 Process not Found 2344 Process not Found 1152 Process not Found 1552 Process not Found 2332 Process not Found 4456 Process not Found 1736 Process not Found 3108 Process not Found 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 1128 Process not Found 4068 Process not Found 1112 Process not Found 1300 Process not Found 3660 Process not Found 2472 Process not Found 2468 Process not Found 1676 Process not Found 2656 Process not Found 2064 Process not Found 4620 Process not Found 2648 Process not Found 1268 Process not Found 676 Process not Found 856 Process not Found 2624 Process not Found 3252 Process not Found 3404 Process not Found 1628 Process not Found 3004 Process not Found 2816 Process not Found 1624 Process not Found 4368 Process not Found 1008 Process not Found 3756 Process not Found 3952 Process not Found 2564 Process not Found 1784 Process not Found 3824 CMD.exe 4244 CMD.exe 448 cmd.exe 3268 Process not Found 784 Process not Found 584 Process not Found 4560 Process not Found 776 Process not Found 772 Process not Found 1152 Process not Found - Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe - Checks whether UAC is enabled 1 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDefenderW3eb32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BootExecutor.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDefenderW3eb32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Process not Found File opened (read-only) \??\V: Process not Found File opened (read-only) \??\X: Process not Found File opened (read-only) \??\A: Process not Found File opened (read-only) \??\I: Process not Found File opened (read-only) \??\Q: Process not Found File opened (read-only) \??\U: Process not Found File opened (read-only) \??\Z: Process not Found File opened (read-only) \??\B: Process not Found File opened (read-only) \??\L: Process not Found File opened (read-only) \??\R: Process not Found File opened (read-only) \??\S: Process not Found File opened (read-only) \??\W: Process not Found File opened (read-only) \??\G: Process not Found File opened (read-only) \??\H: Process not Found File opened (read-only) \??\M: Process not Found File opened (read-only) \??\N: Process not Found File opened (read-only) \??\Y: Process not Found \??\F:\ Process not Found File opened (read-only) \??\E: Process not Found File opened (read-only) \??\J: Process not Found File opened (read-only) \??\K: Process not Found File opened (read-only) \??\O: Process not Found File opened (read-only) \??\P: Process not Found - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 ip-api.com - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 Process not Found - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\System32\Tasks\OneDrive Downloader Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\System32\Tasks\Windows Perfoment Host Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Process not Found - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\BootExecutor.exe 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5004 sc.exe 4672 sc.exe 2336 sc.exe 2224 sc.exe 4748 sc.exe 1940 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4544 cmd.exe 4220 CMD.exe 3016 cmd.exe 448 cmd.exe 4244 CMD.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MalwareDefenderW3eb32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MalwareDefenderW3eb32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MalwareDefenderW3eb32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MalwareDefenderW3eb32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname BootExecutor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain BootExecutor.exe - Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf Process not Found - Checks processor information in registry 2 TTPs 17 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString backgroundTaskHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz backgroundTaskHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier backgroundTaskHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 backgroundTaskHost.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property mousocoreworker.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414} mousocoreworker.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "00184019071F1058" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1" mousocoreworker.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 30 Sep 2026 10:35:21 GMT" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "00184019071F1058" mousocoreworker.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\22b42502-6d21-4789- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000007eabde9dcb51dd019c4e259fcb51dd018ab2089fcb51dd01ab7c15000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000415dc38c2000376130633234353134393038356664386532313165373161323237326162323865353731313736353834616362343665643035333762646161333731336335310000b20009000400efbe415dc38c415dc38c2e0000000000000000000000000000000000000000000000000096a1e000370061003000630032003400350031003400390030003800350066006400380065003200310031006500370031006100320032003700320061006200320038006500350037003100310037003600350038003400610063006200340036006500640030003500330037006200640061006100330037003100330063003500310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000049967ef11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37613063323435313439303835666438653231316537316132323732616232386535373131373635383461636234366564303533376264616133373133633531000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006875617a726173630000000000000000b8ffd2335e15b8428870f8ba9d873dcd992b1b46faadf1119982768fa1516246b8ffd2335e15b8428870f8ba9d873dcd992b1b46faadf1119982768fa1516246ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003500320034003700380038003800300031002d0033003300310038003700340033003000390032002d0034003000350031003200320035003800390033002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c7fddbef000000000000d01200000000000000000000000000000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d95c9d4-3b49-4394- = "8324" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134353499591997372" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59947de9-d5f5-4528- = "\\\\?\\Volume{EFDBFDC7-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\2f9ae4482f585092e6500d02f397a213e7a44a91248552fa6e97a29241b1bcf2" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\22b42502-6d21-4789- = "\\\\?\\Volume{EFDBFDC7-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7a0c245149085fd8e211e71a2272ab28e571176584acb46ed0537bdaa3713c51" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d95c9d4-3b49-4394- = "\\\\?\\Volume{EFDBFDC7-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c17791789f35d80faf30163319566e157622b10e1cb45744d44072c2b95ffea1" Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1 Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59947de9-d5f5-4528- Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59947de9-d5f5-4528- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008ea4f29ccb51dd018ea4f29ccb51dd018ea4f29ccb51dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000415dc38c2000326639616534343832663538353039326536353030643032663339376132313365376134346139313234383535326661366539376132393234316231626366320000b20009000400efbe415dc38c415dc38c2e0000000000000000000000000000000000000000000000000072eeee00320066003900610065003400340038003200660035003800350030003900320065003600350030003000640030003200660033003900370061003200310033006500370061003400340061003900310032003400380035003500320066006100360065003900370061003200390032003400310062003100620063006600320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000049967ef11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32663961653434383266353835303932653635303064303266333937613231336537613434613931323438353532666136653937613239323431623162636632000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006875617a726173630000000000000000b8ffd2335e15b8428870f8ba9d873dcd872b1b46faadf1119982768fa1516246b8ffd2335e15b8428870f8ba9d873dcd872b1b46faadf1119982768fa1516246ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003500320034003700380038003800300031002d0033003300310038003700340033003000390032002d0034003000350031003200320035003800390033002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c7fddbef000000000000d01200000000000000000000000000000000 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fa105362-3838-4f0e- Process not Found Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dde6a55b-7ac6-462d- Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8fd725e0-13ab-4c3e- = 4d907a9fcb51dd01 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" backgroundTaskHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134353500119966194" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fa105362-3838-4f0e- = "0" Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f9750b69-2fcc-495d- = "0" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eff24744-50f6-4333- = a3dd059dcb51dd01 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eff24744-50f6-4333- = "\\\\?\\Volume{EFDBFDC7-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\c17791789f35d80faf30163319566e157622b10e1cb45744d44072c2b95ffea1" Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fa105362-3838-4f0e- Process not Found Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fa105362-3838-4f0e- Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\MuiCache backgroundTaskHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59947de9-d5f5-4528- Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f9750b69-2fcc-495d- = "\\\\?\\Volume{EFDBFDC7-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a81cda4da9c3a8b9abecf98537df5cffbe8dc116302da2d6d0f27320bb57480f" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eff24744-50f6-4333- = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134353499931684536" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59947de9-d5f5-4528- = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f6d068ee-e84f-427a- = "0" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d95c9d4-3b49-4394- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fa105362-3838-4f0e- = "8324" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f53dd155-f3e0-4fee- = "8324" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134353498908403982" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\fa105362-3838-4f0e- = d285089dcb51dd01 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f9750b69-2fcc-495d- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000007c2dfc9ccb51dd017c2dfc9ccb51dd017c2dfc9ccb51dd01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000415dc38c2000613831636461346461396333613862396162656366393835333764663563666662653864633131363330326461326436643066323733323062623537343830660000b20009000400efbe415dc38c415dc38c2e000000000000000000000000000000000000000000000000008465e500610038003100630064006100340064006100390063003300610038006200390061006200650063006600390038003500330037006400660035006300660066006200650038006400630031003100360033003000320064006100320064003600640030006600320037003300320030006200620035003700340038003000660000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000049967ef11000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61383163646134646139633361386239616265636639383533376466356366666265386463313136333032646132643664306632373332306262353734383066000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006875617a726173630000000000000000b8ffd2335e15b8428870f8ba9d873dcd882b1b46faadf1119982768fa1516246b8ffd2335e15b8428870f8ba9d873dcd882b1b46faadf1119982768fa1516246ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003500320034003700380038003800300031002d0033003300310038003700340033003000390032002d0034003000350031003200320035003800390033002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000c7fddbef000000000000d01200000000000000000000000000000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d95c9d4-3b49-4394- = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134353499105122751" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\22b42502-6d21-4789- = "8324" Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e041ef13-f303-4389- Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8fd725e0-13ab-4c3e- Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8fd725e0-13ab-4c3e- = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f9750b69-2fcc-495d- = "8324" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dde6a55b-7ac6-462d- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eff24744-50f6-4333- Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 Process not Found Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c7c1640b-6575-440f- Process not Found Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f9750b69-2fcc-495d- Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\22b42502-6d21-4789- = ab49329fcb51dd01 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f9750b69-2fcc-495d- = 0ce0fe9ccb51dd01 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f6d068ee-e84f-427a- = "8324" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f6d068ee-e84f-427a- = "\\\\?\\Volume{EFDBFDC7-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ac13f8bc5ca60073ed690628afbaf918433809151ceceade881ca0435a18d263" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dde6a55b-7ac6-462d- = "0" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f53dd155-f3e0-4fee- Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8fd725e0-13ab-4c3e- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f53dd155-f3e0-4fee- Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134353498958247271" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59947de9-d5f5-4528- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "134336161937148979" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "134336161940117645" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e041ef13-f303-4389- = "8324" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e041ef13-f303-4389- Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eff24744-50f6-4333- = "8324" Process not Found Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f53dd155-f3e0-4fee- Process not Found - Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5060 schtasks.exe 4884 schtasks.exe 968 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 1772 BootExecutor.exe 1772 BootExecutor.exe 1772 BootExecutor.exe 1772 BootExecutor.exe 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 4172 Process not Found 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 1660 MalwareDefenderW3eb32.exe 1660 MalwareDefenderW3eb32.exe 1660 MalwareDefenderW3eb32.exe 1660 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe 3356 MalwareDefenderW3eb32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Token: SeShutdownPrivilege 3268 Process not Found Token: SeCreatePagefilePrivilege 3268 Process not Found Token: SeAuditPrivilege 2624 Process not Found Token: SeAssignPrimaryTokenPrivilege 2344 Process not Found Token: SeIncreaseQuotaPrivilege 2344 Process not Found Token: SeSecurityPrivilege 2344 Process not Found Token: SeTakeOwnershipPrivilege 2344 Process not Found Token: SeLoadDriverPrivilege 2344 Process not Found Token: SeBackupPrivilege 2344 Process not Found Token: SeRestorePrivilege 2344 Process not Found Token: SeShutdownPrivilege 2344 Process not Found Token: SeSystemEnvironmentPrivilege 2344 Process not Found Token: SeManageVolumePrivilege 2344 Process not Found Token: SeAssignPrimaryTokenPrivilege 2344 Process not Found Token: SeIncreaseQuotaPrivilege 2344 Process not Found Token: SeSecurityPrivilege 2344 Process not Found Token: SeTakeOwnershipPrivilege 2344 Process not Found Token: SeLoadDriverPrivilege 2344 Process not Found Token: SeSystemtimePrivilege 2344 Process not Found Token: SeBackupPrivilege 2344 Process not Found Token: SeRestorePrivilege 2344 Process not Found Token: SeShutdownPrivilege 2344 Process not Found Token: SeSystemEnvironmentPrivilege 2344 Process not Found Token: SeUndockPrivilege 2344 Process not Found Token: SeManageVolumePrivilege 2344 Process not Found Token: SeAssignPrimaryTokenPrivilege 2344 Process not Found Token: SeIncreaseQuotaPrivilege 2344 Process not Found Token: SeSecurityPrivilege 2344 Process not Found Token: SeTakeOwnershipPrivilege 2344 Process not Found Token: SeLoadDriverPrivilege 2344 Process not Found Token: SeSystemtimePrivilege 2344 Process not Found Token: SeBackupPrivilege 2344 Process not Found Token: SeRestorePrivilege 2344 Process not Found Token: SeShutdownPrivilege 2344 Process not Found Token: SeSystemEnvironmentPrivilege 2344 Process not Found Token: SeUndockPrivilege 2344 Process not Found Token: SeManageVolumePrivilege 2344 Process not Found Token: SeAssignPrimaryTokenPrivilege 2344 Process not Found Token: SeIncreaseQuotaPrivilege 2344 Process not Found Token: SeSecurityPrivilege 2344 Process not Found Token: SeTakeOwnershipPrivilege 2344 Process not Found Token: SeLoadDriverPrivilege 2344 Process not Found Token: SeSystemtimePrivilege 2344 Process not Found Token: SeBackupPrivilege 2344 Process not Found Token: SeRestorePrivilege 2344 Process not Found Token: SeShutdownPrivilege 2344 Process not Found Token: SeSystemEnvironmentPrivilege 2344 Process not Found Token: SeUndockPrivilege 2344 Process not Found Token: SeManageVolumePrivilege 2344 Process not Found Token: SeAssignPrimaryTokenPrivilege 2344 Process not Found Token: SeIncreaseQuotaPrivilege 2344 Process not Found Token: SeSecurityPrivilege 2344 Process not Found Token: SeTakeOwnershipPrivilege 2344 Process not Found Token: SeLoadDriverPrivilege 2344 Process not Found Token: SeSystemtimePrivilege 2344 Process not Found Token: SeBackupPrivilege 2344 Process not Found Token: SeRestorePrivilege 2344 Process not Found Token: SeShutdownPrivilege 2344 Process not Found Token: SeSystemEnvironmentPrivilege 2344 Process not Found Token: SeUndockPrivilege 2344 Process not Found Token: SeManageVolumePrivilege 2344 Process not Found Token: SeAssignPrimaryTokenPrivilege 2344 Process not Found Token: SeIncreaseQuotaPrivilege 2344 Process not Found - Suspicious use of UnmapMainImage 1 TTPs 7 IoCs
pid Process 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4284 wrote to memory of 2224 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 92 PID 4284 wrote to memory of 4748 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 94 PID 776 wrote to memory of 3984 776 Process not Found 97 PID 4284 wrote to memory of 3824 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 98 PID 4284 wrote to memory of 4220 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 99 PID 4284 wrote to memory of 4544 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 101 PID 4284 wrote to memory of 1940 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 104 PID 4544 wrote to memory of 5060 4544 cmd.exe 106 PID 4220 wrote to memory of 1408 4220 CMD.exe 107 PID 4284 wrote to memory of 5004 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 108 PID 3268 wrote to memory of 4840 3268 Process not Found PID 3268 wrote to memory of 4840 3268 Process not Found PID 4284 wrote to memory of 2336 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 113 PID 4284 wrote to memory of 4672 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 115 PID 776 wrote to memory of 3424 776 Process not Found 117 PID 3356 wrote to memory of 4244 3356 MalwareDefenderW3eb32.exe 118 PID 3356 wrote to memory of 448 3356 MalwareDefenderW3eb32.exe 119 PID 3356 wrote to memory of 3016 3356 MalwareDefenderW3eb32.exe 121 PID 4244 wrote to memory of 1260 4244 CMD.exe 124 PID 4244 wrote to memory of 1260 4244 CMD.exe 124 PID 448 wrote to memory of 4884 448 cmd.exe 125 PID 448 wrote to memory of 4884 448 cmd.exe 125 PID 3016 wrote to memory of 968 3016 cmd.exe 126 PID 776 wrote to memory of 920 776 Process not Found 127 PID 776 wrote to memory of 920 776 Process not Found 127 PID 3268 wrote to memory of 4280 3268 Process not Found PID 3268 wrote to memory of 4280 3268 Process not Found PID 776 wrote to memory of 4336 776 Process not Found 131 PID 776 wrote to memory of 4336 776 Process not Found 131 PID 776 wrote to memory of 2312 776 Process not Found 132 PID 776 wrote to memory of 2640 776 Process not Found 133 PID 4284 wrote to memory of 1660 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 134 PID 4284 wrote to memory of 1660 4284 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe 134 PID 3268 wrote to memory of 2780 3268 Process not Found PID 3268 wrote to memory of 2780 3268 Process not Found PID 776 wrote to memory of 3688 776 Process not Found 137 PID 776 wrote to memory of 3948 776 Process not Found 139 PID 776 wrote to memory of 3944 776 Process not Found 140 PID 776 wrote to memory of 3944 776 Process not Found 140 PID 776 wrote to memory of 1236 776 Process not Found 141 PID 776 wrote to memory of 5116 776 Process not Found 142 PID 776 wrote to memory of 4332 776 Process not Found 143 PID 776 wrote to memory of 4332 776 Process not Found 143 PID 776 wrote to memory of 4608 776 Process not Found 145 PID 776 wrote to memory of 4272 776 Process not Found 146 - System policy modification 1 TTPs 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MalwareDefenderW3eb32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" BootExecutor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MalwareDefenderW3eb32.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Checks computer location settings
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4284 -
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend2⤵
- Launches sc.exe
PID:2224
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand2⤵
- Launches sc.exe
PID:4748
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe" enable=yes & exit2⤵
- Loads dropped DLL
PID:3824
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Windows Perfoment Host" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Windows Perfoment Host"3⤵PID:1408
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Windows Perfoment Host" /tr "C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Windows Perfoment Host" /tr "C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5060
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend2⤵
- Launches sc.exe
PID:1940
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand2⤵
- Launches sc.exe
PID:5004
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend2⤵
- Launches sc.exe
PID:2336
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand2⤵
- Launches sc.exe
PID:4672
-
-
C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe"C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1660
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:3984
-
C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exeC:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3356 -
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "Windows Perfoment Host" & exit2⤵
- Loads dropped DLL
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Windows Perfoment Host"3⤵PID:1260
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Windows Perfoment Host" /tr "C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe" & exit2⤵
- Loads dropped DLL
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Windows Perfoment Host" /tr "C:\Users\Admin\AppData\Local\MalwareDefenderW3eb32.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4884
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive Downloader" /tr "C:\Windows\BootExecutor.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "OneDrive Downloader" /tr "C:\Windows\BootExecutor.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:968
-
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:3424
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:920
-
C:\Windows\BootExecutor.exeC:\Windows\BootExecutor.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1772
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4336
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2312
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2640
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵PID:3500
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3688
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3948
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
PID:3944
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1236
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
- Checks processor information in registry
- Modifies registry class
PID:5116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4332
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4608
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4272
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Process Injection
1Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
4Indicator Removal
1Clear Windows Event Logs
1Modify Registry
8Pre-OS Boot
1Bootkit
1Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\USOPrivate\UpdateStore\store.db
- Size 60KB
- SHA256 a33b9e77acec3bf4b8da27a0f27417d9bf25d3db2a82e0586441b42c2ac41b02
- MD5 152a41e7e25ae644ce58080d2535ac8c
- SHA1 9b7c6569eededc124ef4f2263e27073644f83c1c
- SHA512 5fe9cc89c98360424621273af43f1fe9add6e2b6924056d25842f9bf2eba31ca627b8d36275aa0e36cd6caac1d6c2672e9ba26cfc01c5288e9a7b457ea4527cb
- SSDEEP 96:hG9G5OGFGnGiesG9GURGznkTa7RDp8dG9G5OGFGnGivsG9GURGzn3G9GoQQGHGiS:ZKkTaFVjKe
- TLSH T1C9539D217AED7224FA6270F58FECD845CB27FAA8063B921F205E668717E7D055E41331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
- Size 330B
- SHA256 82ebaa2047291bde6bbcb83cd4973c8e57108551edf4379e37467dc53264414f
- MD5 6db43875dffc9b26278c6138b2f430de
- SHA1 9c86eb839496e6e96e1eefafa15f8b09b5cfbcc6
- SHA512 b5280ed390a26fe4660552706f6a9b5039e82f7192dd2e90cceaed21e827c68a24e76b7c810256e406f4d2e6062890bc1e5124c601306d4e7bf7fef7b20f704c
- TLSH T1B8E0C2163AE40200F5338A3CD872AE605632B7E7A900C68D0B79408E1C79F209C7331B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
- Size 330B
- SHA256 5644cc61d6bd623bdc4bd02d2119a7cf320b8e6de14432dcbe3f9fbb8046f19c
- MD5 9633267a04d370c5f7e956ecb1e03748
- SHA1 db09ae91c99e3c1c36c50fb2a2b4e4c81df67b18
- SHA512 b3ace6f918ec948b5ac42558c4129535fbe1ab8757b35f50b0f684069a41c7bd14fe7149a35f29c23dd2915ebc7457f008cb905a98468b5f5c8ee9f414978ca2
- TLSH T132E0C25536E40302F9B34B3C2961A5860E36B613AC12CA9D4BBA024C1C74F21D9B3319
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat.~tmp
- Size 1KB
- SHA256 e278ea77c483f673c2144a31439ddd415c1c795a0ed5d5ad7b5fad26a0ace3fc
- MD5 a4b459f87d3d4a6952c55c239ef4e984
- SHA1 7487e646740165e6e15f2a2935180888ed5580fd
- SHA512 8b2d7a3e73ed6484b81dfa9723a871bd67cf0d83955599924bbe386d7fb935148843d818816cf5fab614e3f5d9117d5051cbb9f7e0102bbbe6349e6def779733
- TLSH T16921475F31B084F0CFC460C40003B71D2B5A3FEB88CF505466E0570D85C951B982E396
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat.~tmp
- Size 602B
- SHA256 5a6f4e3ee24bd176f82cec8ca7e14198962751557168eff7d6129c23564f0340
- MD5 7892b948349f16bc0a66669fccfa2958
- SHA1 bd0249c0f78b9207c10f225d747d647b9462a8c2
- SHA512 3c4056a2f24251de318401a3d5016c22ad683667d2b7f4a44b7c47ac6789294c22b5b8207e77fa80afc380cb6c71f78c29e9ba55d88fbffe82d7367a67f30c2f
- TLSH T19AF0E75F31B194F0CFC464C51003B71D2B5A3FEB88DF505566E4570D85C955B982E396
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\imprbeacons.dat.~tmp
- Size 1KB
- SHA256 9bfbcdf82a5e18e31ca553d472b61333441cf8cce39963d1fed57868a807bf69
- MD5 86c266b156fc69a7536f30108c2b33b2
- SHA1 50136278a22e17ffca17a90a89ff75961d0bcd94
- SHA512 f7718779a26cc661c4f7bd640a9c817aa82f49738c256f009b83a995c387a2300156f92fbefbaeef4d676a63bca0758c09e520a126b631a1fbbe7846dbff6ef9
- TLSH T19E31859A345124B0CFC834C32107375A9B4A7BB720CBB268A9CAC7EC98C75765D7CE49
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1790876285.~tmp
- Size 336B
- SHA256 421b1363e56751a937bfe56d8df6fbc32103eb6a8a06db29dcb017f7452c092a
- MD5 398a9dff4665f2a3a8ec82b0670c148d
- SHA1 ec672723bcb4fdbb7608d0d022e8d40482fc612a
- SHA512 ad52f1a89902ec4e3ec7723ce2d8283381677db5e63b5aab11f714465377d697e224b7d804d1500ff9c6b0f4174134e7f76c5005fd69594cdb7ed23a789250d1
- TLSH T1C5E0C28D57F5110DB571AB0355F3504E58393C82AC7AD51E40411F0E0832E50D521B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1790876360.~tmp
- Size 336B
- SHA256 998cec8a2fa730ae974ceee525aa0c197c137ac30431fc8264a633b07e1fba67
- MD5 286a51e3ad6547b034457d78b306a9e6
- SHA1 7dea0edc8bcfbd7e1701c98be9dd3dae3e144b84
- SHA512 ff35534daeed5afa3357de9b904b50baddd5b207aa96ed124baed36ba28b5a8ef39d412475b1afe442442bc106925df102b251a26d87917cde2418c42d89c675
- TLSH T1B5E0C28E57F5114DB572AB1715F3404D18393C81AC7AD51E40801F4E0832E40D521B27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\ebb3d063e9c44e05a74d2f20aac9cc48_1.~tmp
- Size 1KB
- SHA256 e51a64afc6bf1d5b575175b9c805e6aee03adbc6f28f217ff55710fa5f44267c
- MD5 e00791c77c2a366eb35496dc57aa5499
- SHA1 b1fc9af7063834d5afa4e8f75c18cc32252d91f5
- SHA512 4c16533ea74c95d7b1efaaced17e61ddc3be96b5107703cc9071b8c10ed40fe8849c83612eaf8b19ce6d147b9904515b0dbd67592d8957f3eddb259f1e51a70b
- TLSH T1A03196695310D8F5D7CDA16AD02B759164393BABE5FE44901EE80F0C85D07868DA278F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\0433f4f3b08c4ac382258c613ff679c9_1.~tmp
- Size 9KB
- SHA256 e8e0aed4e00b166a99f3141a4863dda01fe8ec65f3291fa9469e3887e0373e18
- MD5 bc48e354c2152faffcc49b0dc748cf71
- SHA1 491336d162567f1857acf8f41ee9ba67977a947f
- SHA512 7084bf2df24c6a1d55d42fdbaa3a6e02afcac79b890e2f716f6ba95f6305b97de672284803037cd70046bf8b14c9f3dbfac7df62cf1f035a04c5fe292bce75dd
- SSDEEP 192:nQprnQArcAvKbLWhtlHB56JAWFjSnJxF9qHJIw:QarGO5FjAn9kP
- TLSH T15612CB87B244EE70DAC6229B555F3D035D3432BFF2D84D282AD80E2407D96DF74662AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\ca4f33734eba4bb3be05ce1c3bb2494c_1.~tmp
- Size 9KB
- SHA256 bda840b6db3466027acf6b7928239e29dc86676a3c86b29ceca6da1876e82865
- MD5 7227daa699604420ba39f32858b084fb
- SHA1 e5084642a669541c5ccf3e9251b5740dfbe619f0
- SHA512 a94177fc66b5e056b5acd09fb2e0bd1a8237736cabb1bf6f6ed9b95a7a8af9f588c68503100f167fa714c65fb6aeccd08853308ac4038aa279524c621ad18c10
- SSDEEP 192:z7RxtCBAvKk5XLexO5tlHB5N78Ay7cxT78xty5Dxr/078Icl:Rxr5X6xuwngx0Xy5DxrHxl
- TLSH T10C12D887B294EE70D585115F545F7E03443836AFF2D80D692ADC0E240ACF7DE742A26B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\d493718941c942c9bd369483d63338e6_1.~tmp
- Size 9KB
- SHA256 540045a0d686bd5ef0b37965b7134b78145d24a4fca560343f6cb2e8581cd360
- MD5 7e4804a957c257f45768fd239939aabb
- SHA1 b501e115aec3aa896844ecb927990efd792973dd
- SHA512 069f9b68d4ba922fe8ab1dbce335434cf220e6665b0fcca913144d2987e9ed947b216b6f0c23d57cbefb81d1d788df4158639a7083aac6f4e5cf4d6a9bbcc5ad
- SSDEEP 192:HU6qDuAvKjLV2tlHB5vpA/rpxmtlt9IpIT:0W+vCN872E
- TLSH T1BC12E98B7350EA31DA8A515A510F7E035835327FF7D85C1857E80E600AF96DFB4622AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\1586bf82dd714721a75da69f5bd404ec_1.~tmp
- Size 3KB
- SHA256 56b09d84cc1b1bc71240ce90ba506510b3ca3e798897a7dc9b527cbeea466b0f
- MD5 f3c7caa4e639441ce31b186bb5cb35b7
- SHA1 f65e8e5e2e989cf8d68b5a3ce766767950dd8663
- SHA512 a2979257a54f74d4ebaf388c44d44f737e7299480c59cc5a47985a2a2df3021cd3328843656253060a7a3f328023deef773994853385b38088db8db12473b74e
- TLSH T12561949F3250DDB2DBCC61898107BB0924A53BEBE4DD6004AAE41F1D4ACC68A243E25E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\88000045\6e3314f1b21f4a33b3f8bbc1c2b573e2_1.~tmp
- Size 1KB
- SHA256 ee45c1e85f9c8a84eb844b1f1655d5823fc6b7accd622c0b7780d04fb9906fd8
- MD5 c2514ce1d012d21255538fb7494d40f7
- SHA1 5d07eac6755d85c4792355ccbe5f55f339628496
- SHA512 7a78c1567704b890bbe18ecdaae9da8cda3aa7df5c3d8352f831a78234d78f648e9e9c2d4afd5d56ae5f7dd391e4211e3de49bb0d257781826a0476b1c904bc0
- TLSH T17131765A2354D872E5CC21C9D41B7551193637ABF6EF18602AE81F8C87D47EA091630F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\1e198e1a-7b2b-4836-aff0-241c55f0f92e.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\frasty\AppData\Local\Boot.exe
- Size 376KB
- SHA256 679c2f04992033c40f369510803be182398d72986e5ebb59da797da6aed5e93b
- MD5 2024cdab99af677c0b34660597acaff2
- SHA1 ca60603f8e452e49fee3e4fcb95b3a2b926cc75f
- SHA512 9b856df06fdf823449d05e181836bf418e71ed2548047646cbddbbbb567ff1eb47f2d4506671c435167a421b970f3287079aace63a186d113d5e95d94be26a6c
- SSDEEP 6144:EJebwX9wz4ZoeETEW1gbpJA3KpSL0pDSNiKbh:EJebW9ULePJA3KY0p6i2
- TLSH T1BF845B43BBD100BAE5BE463844735619A73AF8114B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- Size 2KB
- SHA256 2ea8191335f33369dab2d18afe09d4352e1588541ffa6ab37455f81ca68a6b59
- MD5 bf0ec340f4cf0d7bf99eb2e32a3a357c
- SHA1 42e17023b14602b2413fbe0aa88660c5ee81f712
- SHA512 f0263c6f669b552625c06e284a38ead9085301061ddf82c97858e8a6832bd527f40f141129acac7853c6df59a47cf0de4a68204e5ef926d565e9cfe81bb7dfe6
- TLSH T1F051465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- Size 2KB
- SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
- MD5 8abf2d6067c6f3191a015f84aa9b6efe
- SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
- SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
- TLSH T1A451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- Size 2KB
- SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
- MD5 f313c5b4f95605026428425586317353
- SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
- SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
- TLSH T1D451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
- MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
- SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
- SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
- TLSH T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
- MD5 7d612892b20e70250dbd00d0cdd4f09b
- SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
- SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
- TLSH T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
- MD5 0b990e24f1e839462c0ac35fef1d119e
- SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
- SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
- TLSH T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\OneDrive Downloader
- Size 3KB
- SHA256 7594526a8ebb716f710e98ec29463e5811bf7c9a46dd445b1cfbb6d7573f7f93
- MD5 17df35ea66b9abd244dbe08319093787
- SHA1 9782569cb5cc281fac525de1373fdff39b55187f
- SHA512 94e7329b7ba16111e6f6fbdb9502cfff01b8f0ef595ecb01834a3bd1bde275515fbd0f06696d5a5529c0539444b3f93f9047c53dcab262a434f62b66d48fb0fa
- TLSH T11F71474767EE1109F1F36B6CAEBB50628A67BD555938C46D00AC240DCBF3E2285607BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Windows Perfoment Host
- Size 3KB
- SHA256 01ffbdbef0b3f10f49ff32dcf6d54aca8f8a4ae329c672076803461329bef08f
- MD5 2848de5b6dc2326b1df4485e99002fd1
- SHA1 29f1e57760c8a479e2ce8dbeca999b10dd771bcb
- SHA512 6637063ab18658aea5426e317c4348b8ad2d7e06f9dada5cb3d5808a5534b4be77edb93af45ec6b51fc6277107a49651f7eac8584791795669d6e58df67d03aa
- TLSH T19D61575367EE1109F2F76B6CBEB750228A67BD515938C46D00AC240DCBF3E2285607BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Windows Perfoment Host
- Size 3KB
- SHA256 b882ed301a01dcc234bf833ae4a878aa2aacf0a38b12f11d22191387f9ae4dde
- MD5 96d47bffaa122ca2572c73d655f89efe
- SHA1 5bee3b9ec36d807af860ab01fa9b247d902cf7a9
- SHA512 77ddb32a2d94959f4dba8742ec9cdc0274f6eb01449d29dfa13f6225b13ee11660571310d5f8d7fbef0f89f3307df50222a221066ad36ff0967960c6787a1dfd
- TLSH T10361475367EE1109F2F76B6CBEB750228A67BD555938C46D00AC240DCBF3E2285607BB
- MD5 SHA1 SHA512 TLSH