Zero‑Dwell Threat Intelligence Report
A narrative, executive‑ready view into the malware’s behavior, exposure, and reliable defenses.
Generated: 2026-02-19 10:34:34 UTC
Executive Overview — What We’re Dealing With
This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.
File
rtgm5uo.exe
Type
Win64 Executable (generic)
SHA‑1
ba493d2c998cdb89d6e6a23ad0ee70b4494f3ce2
MD5
a662b16eb2660ef3865853b74e5177b1
First Seen
2026-02-18 11:15:50.789090
Last Analysis
2026-02-18 17:56:36.572924
Dwell Time
0 days, 7 hours, 33 minutes
Extended Dwell Time Impact
For 6+ hours, this malware remained undetected — a several-hour window that allowed the adversary to complete initial compromise and begin early-stage persistence establishment.
Comparative Context
Industry studies report a median dwell time closer to 21–24 days. This case represents rapid detection and containment within hours rather than days.
Timeline
| Time (UTC) | Event | Elapsed |
|---|---|---|
| 2025-11-26 10:49:39 UTC | First VirusTotal submission | — |
| 2026-02-19 09:31:17 UTC | Latest analysis snapshot | 84 days, 22 hours, 41 minutes |
| 2026-02-19 10:34:34 UTC | Report generation time | 84 days, 23 hours, 44 minutes |
Why It Matters
Every additional day of dwell time is not just an abstract number — it is attacker opportunity. Each day equates to more time for lateral movement, stealth persistence, and intelligence gathering.
Global Detection Posture — Who Caught It, Who Missed It
VirusTotal engines: 70. Detected as malicious: 44. Missed: 26. Coverage: 62.9%.
Detected Vendors
- Xcitium
- +43 additional vendors (names not provided)
List includes Xcitium plus an additional 43 vendors per the provided summary.
Missed Vendors
- Acronis
- APEX
- Avira
- Baidu
- Bkav
- ClamAV
- CMC
- DrWeb
- F-Secure
- Fortinet
- google_safebrowsing
- Gridinsoft
- Jiangmin
- MaxSecure
- Panda
- SentinelOne
- SUPERAntiSpyware
- TACHYON
- tehtris
- Trapmine
- VirIT
- Webroot
- Xcitium
- Yandex
- ZoneAlarm
- Zoner
Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.
MITRE ATT&CK Mapping
- T1129 – access PEB ldr_data
- T1057 – get process heap force flags
- T1129 – get kernel32 base address
- T1027 – encrypt data using RC4 PRGA
- T1027 – reference Base64 string
- T1027 – encrypt data using AES via x86 extensions
- T1027 – The binary contains an unknown PE section name indicative of packing
- T1027.002 – The binary contains an unknown PE section name indicative of packing
- T1486 – Exhibits possible ransomware or wiper file modification behavior: mass_file_deletion overwrites_existing_files
- T1036 – Creates files inside the user directory
- T1082 – Queries the cryptographic machine GUID
- T1082 – Queries the volume information (name, serial number etc) of a device
Following the Trail — Network & DNS Activity
Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.
Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.
Persistence & Policy — Registry and Services
Registry and service telemetry points to policy awareness and environment reconnaissance rather than noisy persistence. Below is a compact view of the most relevant keys and handles; expand to see the full lists where available.
Registry Opened
52
Registry Set
89
Services Started
0
Services Opened
0
Registry Opened (Top 25)
| Key |
|---|
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{871425f5-0000-0000-0000-d01200000000} |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E01C0 |
| HKEY_CURRENT_USER\Software\Classes\Local Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders\ |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${a24c164a-dcf8-4844-af66-4dd3ddac01d9}$start.tilegrid$windows.data.curatedtilecollection.tilecollection\Current |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\Software |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\Instance\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList |
| HKEY_CURRENT_USER\Software |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B0058 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\ToastAppIdentities\Microsoft.Explorer.Notification.{F3021280-8B71-AE51-7BF9-DAA692344272} |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows |
| HKEY_CURRENT_USER\Software\Classes |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\ToastAppIdentities |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Disable8And16BitMitigation |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppModel\Lookaside\user |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Cryptography |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages\en-US |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap |
| HKEY_LOCAL_MACHINE\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\MUI\Settings |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Wow64\x86 |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppModel\Lookaside\machine |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs |
Show all (52 total)
| Key |
|---|
| HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Cryptography\Offload |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
Registry Set (Top 25)
| Key | Value |
|---|---|
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-4226853953-3309226944-3078887307-1000\C:\qjqmfgni\fibnc.exe | \x6f\x8b\x30\x27\xa7\x60\xdc\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\50 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Skype for Business Recording Manager.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\OcPubMgr.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@C:\PROGRA~2\COMMON~1\MICROS~1\Office16\oregres.dll,-429 | Skype for Business 2016 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\Favorites | \x00\x56\x01\x00\x00\x3a\x00\x1f\x80\xc8\x27\x34\x1f\x10\x5c\x10\x42\xaa\x03\x2e\xe4\x52\x87\xd6\x68\x26\x00\x01\x00\x26\x00\xef\xbe\x12\x00\x00\x00\x3a\x42\x35\xea\x53\xec\xda\x01\x31\x26\x02\x81\x54\xec\xda\x01\xcd\x83\x07\x81\x54\xec\xda\x01\x14\x00\x56\x00\x31\x00\x00\x00\x00\x00\x0c\x59\x63\x09\x10\x00\x54\x61\x73\x6b\x42\x61\x72\x00… |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\26 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\lync.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\46 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk\n%ProgramFiles%\Java\jre1.8.0_77\bin\javacpl.exe\n-tab about |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\comres.dll,-3410 | Component Services |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesResolve | \xec\x02\x00\x00\x4c\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46\x83\x00\x80\x00\x20\x00\x00\x00\x7a\x11\x07\x81\x54\xec\xda\x01\x0b\x5c\x0c\x81\x54\xec\xda\x01\x73\xc7\x4d\xb8\x53\xec\xda\x01\x8d\x09\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x52\x01\x3a\x00\x1f… |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\ImmersiveControlPanel\systemsettings.exe,-650 | Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\22 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\EXCEL.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000E01C0\VirtualDesktop | \x10\x00\x00\x00\x30\x30\x44\x56\x5e\x9f\x3f\xc8\xfe\x91\xf3\x49\xa5\x21\xb5\x21\xae\xc8\x3b\xfb |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\30 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk\n%ProgramFiles%\Java\jre1.8.0_77\bin\javacpl.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\mycomput.dll,-300 | Computer Management |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesChanges | 0x0000000B |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\48 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk\n%ProgramFiles%\Java\jre1.8.0_77\bin\javacpl.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\wsecedit.dll,-718 | Local Security Policy |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\wdc.dll,-10021 | Performance Monitor |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\34 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Telemetry Dashboard for Office 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\msotd.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\20 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\MSACCESS.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\53 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Telemetry Log for Office 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\msoev.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\SnippingTool.exe,-15051 | Snipping Tool |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\35 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Telemetry Log for Office 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\msoev.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF | \x01\x00\x00\x00\x00\x00\x00\x00\x20\xba\x0f\x1c\xa7\x60\xdc\x01 |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@C:\PROGRA~2\COMMON~1\MICROS~1\Office16\oregres.dll,-416 | Office 2016 Language Preferences |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\Taskmgr.exe,-32420 | Task Manager |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop\IconNameVersion | 0x00000001 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B0058\VirtualDesktop | \x10\x00\x00\x00\x30\x30\x44\x56\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\System32\AuthFWGP.dll,-20 | Windows Defender Firewall with Advanced Security |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\55 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk\n%ProgramFiles%\WinRAR\WinRAR.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\InstalledWin32AppsRevision | {9BB418C8-046C-42F8-B383-A59818926834} |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\45 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\WINWORD.EXE\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\dfrgui.exe,-103 | Defragment and Optimize Drives |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\38 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\MSACCESS.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\54 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Steam\Steam.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\MdSched.exe,-4001 | Windows Memory Diagnostic |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\Speech\SpeechUX\sapi.cpl,-5555 | Windows Speech Recognition |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\iscsicpl.dll,-5001 | iSCSI Initiator |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\25 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\MSPUB.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\33 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Spreadsheet Compare 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF | \x01\x00\x00\x00\x00\x00\x00\x00\x7e\x6a\x33\x1c\xa7\x60\xdc\x01 |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\regedit.exe,-16 | Registry Editor |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\44 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\lync.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@C:\PROGRA~2\COMMON~1\MICROS~1\Office16\oregres.dll,-436 | Telemetry Dashboard for Office 2016 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\28 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk\n%ProgramFiles%\Java\jre1.8.0_77\bin\javacpl.exe\n-tab about |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\pmcsnap.dll,-700 | Print Management |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-4226853953-3309226944-3078887307-1000\%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe | \x5c\x0b\x08\x04\xa7\x60\xdc\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\24 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\POWERPNT.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\36 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Steam\Steam.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\52 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Telemetry Dashboard for Office 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\msotd.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\quickassist.exe,-806 | Quick Assist |
Show all (89 total)
| Key | Value |
|---|---|
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe,-102 | Windows PowerShell ISE (x86) |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\filemgmt.dll,-2204 | Services |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\32 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Skype for Business Recording Manager.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\OcPubMgr.exe\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@C:\PROGRA~2\COMMON~1\MICROS~1\Office16\oregres.dll,-432 | Skype for Business Recording Manager |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@C:\PROGRA~2\COMMON~1\MICROS~1\Office16\oregres.dll,-467 | Office 2016 Upload Center |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\27 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\WINWORD.EXE\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\miguiresource.dll,-201 | Task Scheduler |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exe | REG_QWORD |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\51 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Spreadsheet Compare 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\mstsc.exe,-4000 | Remote Desktop Connection |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\47 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk\n%ProgramFiles%\Java\jre1.8.0_77\bin\javacpl.exe\n-tab update |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\msconfig.exe,-5006 | System Configuration |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\23 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\ONENOTE.EXE\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe,-101 | Windows PowerShell ISE |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop\IconLayouts | \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x01\x00\x01\x00\x01\x00\x21\x00\x00\x00\x00\x00\x00\x00\x2c\x00\x00\x00\x00\x00\x00\x00\x3a\x00\x3a\x00\x7b\x00\x36\x00\x34\x00\x35\x00\x46\x00\x46\x00\x30\x00\x34\x00\x30\x00\x2d\x00\x35\x00\x30\x00\x38\x00\x31\x00\x2d\x00\x31\x00\x30\x00\x31\x00\x42\x00\x2d\x00\x39… |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC3475 | \xc4\x00\x00\x00\x00\x00\x00\x00\x04\x00\x04\x00\x01\x02\x06\x00\x00\x00\x00\x00\x06\x00\x00\x00\x6b\x50\x7e\x00\x02\x00\x00\x00\x87\xde\x83\x00\x02\x00\x00\x00\x90\xa6\xa1\x01\xc8\x02\x00\x00\xa1\x9f\x5e\x00\x05\x00\x00\x00\xdb\xb4\xef\x00\x01\x00\x00\x00\xfe\xd3\x7a\x00\x05\x00\x01\x00\x00\x00\x08\x00\x00\x00\x18\x7d\xc7\x00\xfd\x00\x00… |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\miguiresource.dll,-101 | Event Viewer |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\msinfo32.exe,-100 | System Information |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\49 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Database Compare 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@C:\PROGRA~2\COMMON~1\MICROS~1\Office16\oregres.dll,-438 | Telemetry Log for Office 2016 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\43 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\MSPUB.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\31 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\Database Compare 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE\n |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\mip.exe,-291 | Math Input Panel |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\RecoveryDrive.exe,-500 | Recovery Drive |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\psr.exe,-1701 | Steps Recorder |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\FXSRESM.dll,-114 | Windows Fax and Scan |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\wdc.dll,-10030 | Resource Monitor |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesVersion | 0x00000003 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore\ResetCache | 0x00000001 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\42 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\POWERPNT.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\StateStore\ResetCacheCount | 0x00000003 |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3e\52C64B7E\@%WINDIR%\system32\odbcint.dll,-1694 | ODBC Data Sources (64-bit) |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\29 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk\n%ProgramFiles%\Java\jre1.8.0_77\bin\javacpl.exe\n-tab update |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\40 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\EXCEL.EXE\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\21 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\37 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk\n%ProgramFiles%\WinRAR\WinRAR.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\39 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe\n |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC\41 | %ALLUSERPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk\n%ProgramFiles%%ProgramFiles(x86)%\Microsoft Office\Office16\ONENOTE.EXE\n |
| HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile | Binary Data |
Services Started (Top 15)
Services Opened (Top 15)
What To Do Now — Practical Defense Playbook
- Contain unknowns: block first‑run binaries by default — signatures catch up, containment works now.
- EDR controls: alert on keyboard hooks, screen capture APIs, VM/sandbox checks, and command‑shell launches.
- Registry watch: flag queries/sets under policy paths (e.g., …\FipsAlgorithmPolicy\*).
- Network rules: inspect outbound TLS to IP‑lookup services and unexpected CDN endpoints.
- Hunt broadly: sweep endpoints for the indicators above and quarantine positives immediately.
Dwell time equals attacker opportunity. Reducing execution privileges and egress shrinks that window even when vendors disagree.