Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 13:46
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230831-en
General
-
Target
client.exe
-
Size
296KB
-
MD5
3f39517fb0f5de4ba10e72242fb6cd9a
-
SHA1
d9c68d8110038c21b9d1c5763eab9331c2cf3b45
-
SHA256
b3a2a819e27b004310e65c2b6b000cb8444b3233271a5064e5314d9580d128d3
-
SHA512
c69a9438a9915724233aff2a45a25421a33d05ff2fdcaa7ffdef7dd67f2c27aa1f0894e1c0b11def837d01515dbf42931d4ac829a0ea6a40b115002e615f7ebe
-
SSDEEP
3072:pqrRrmv3TwaCRNnA/UeXFa3mSRACC2IS/gc/LRxNuIY:QrRyvDwaCRNn4XQ2wACZgc/LR/u
Malware Config
Extracted
gozi
Extracted
gozi
5050
185.247.184.139
62.72.33.155
incontroler.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
expirew.com
whofos.com
onlinepoints.online
onlinepoints.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 3260 set thread context of 3140 3260 powershell.exe Explorer.EXE PID 3140 set thread context of 3728 3140 Explorer.EXE RuntimeBroker.exe PID 3140 set thread context of 4084 3140 Explorer.EXE RuntimeBroker.exe PID 3140 set thread context of 4896 3140 Explorer.EXE RuntimeBroker.exe PID 3140 set thread context of 1308 3140 Explorer.EXE RuntimeBroker.exe PID 3140 set thread context of 4668 3140 Explorer.EXE cmd.exe PID 4668 set thread context of 344 4668 cmd.exe PING.EXE PID 3140 set thread context of 1980 3140 Explorer.EXE cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4780 1984 WerFault.exe client.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e22215e7-c727-4305 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\80e06738354578ffd4356f7359aad68a5f3f3d1c86183e1e7d0c8515d8eb3105" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59e59ead-bb3d-4a2e = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\98093396-012c-4e12 = fe20b63000f6d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3a0a435-5112-4336 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b4034ee0534ae40a51ca5076eed59e068538c379e82f76e5cd3541838687b17f" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\88fe3599-e809-4339 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3a0a435-5112-4336 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0af101c1-b404-4e7c RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\41bbe20a-98fd-443a = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\88fe3599-e809-4339 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\88fe3599-e809-4339 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\823e51354633ead99f6fc8b911ff2d8d608a330bfce80e60beb3ae9bdfac4758" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6519fb-7ac5-4c9d = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0af101c1-b404-4e7c = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\823e51354633ead99f6fc8b911ff2d8d608a330bfce80e60beb3ae9bdfac4758" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a0cebac2-2a95-4a30 = bead543100f6d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\72893742-1f38-408a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a5c4ef3000f6d9015b88323100f6d9015b88323100f6d901f64405000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357f86d2000653430336335313139613161313964613634383137313864373430386235356237326664323237613935316638313761396435636366336532613931653163310000b20009000400efbe4357f86d4357f86d2e00000000000000000000000000000000000000000000000000bb582301650034003000330063003500310031003900610031006100310039006400610036003400380031003700310038006400370034003000380062003500350062003700320066006400320032003700610039003500310066003800310037006100390064003500630063006600330065003200610039003100650031006300310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000006e12d80e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65343033633531313961316131396461363438313731386437343038623535623732666432323761393531663831376139643563636633653261393165316331000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07b166ee959753ee119d98feac1aa35865e045a29211b9ef448bb64d5290c16b07b166ee959753ee119d98feac1aa35865d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\98093396-012c-4e12 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6519fb-7ac5-4c9d = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000044efb83000f6d90144efb83000f6d90144efb83000f6d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357f86d2000343964373134306565646165663134643464313134363361653339356463623532613734396261373834363335323261643137613433313965653363616131370000b20009000400efbe4357f86d4357f86d2e00000000000000000000000000000000000000000000000000bcaa1201340039006400370031003400300065006500640061006500660031003400640034006400310031003400360033006100650033003900350064006300620035003200610037003400390062006100370038003400360033003500320032006100640031003700610034003300310039006500650033006300610061003100370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000006e12d80e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34396437313430656564616566313464346431313436336165333935646362353261373439626137383436333532326164313761343331396565336361613137000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07ad66ee959753ee119d98feac1aa35865e045a29211b9ef448bb64d5290c16b07ad66ee959753ee119d98feac1aa35865d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a2148d79-52a3-4a32 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0af101c1-b404-4e7c = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b79ad713-d1bb-4252 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e22215e7-c727-4305 = cca19d3000f6d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e22215e7-c727-4305 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59e59ead-bb3d-4a2e RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\41bbe20a-98fd-443a = 5c18e33100f6d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4a9ced5c-697f-4a3c RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\df7450e1-feec-45db = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0af101c1-b404-4e7c = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f015fe3000f6d90138ac393100f6d90138ac393100f6d901196c05000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357f86d2000383233653531333534363333656164393966366663386239313166663264386436303861333330626663653830653630626562336165396264666163343735380000b20009000400efbe4357f86d4357f86d2e00000000000000000000000000000000000000000000000000310c1501380032003300650035003100330035003400360033003300650061006400390039006600360066006300380062003900310031006600660032006400380064003600300038006100330033003000620066006300650038003000650036003000620065006200330061006500390062006400660061006300340037003500380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000006e12d80e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38323365353133353436333365616439396636666338623931316666326438643630386133333062666365383065363062656233616539626466616334373538000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07b366ee959753ee119d98feac1aa35865e045a29211b9ef448bb64d5290c16b07b366ee959753ee119d98feac1aa35865d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\41bbe20a-98fd-443a = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\49d7140eedaef14d4d11463ae395dcb52a749ba78463522ad17a4319ee3caa17" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\88fe3599-e809-4339 = 5169b93000f6d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6519fb-7ac5-4c9d RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a0cebac2-2a95-4a30 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f250da3000f6d901fac12d3100f6d901fac12d3100f6d901b32309000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357f86d2000666565623937383230373835343938623635306539653664363131386266306430626232383965323461306664306334346163653064383330363530666561310000b20009000400efbe4357f86d4357f86d2e000000000000000000000000000000000000000000000000003a951e01660065006500620039003700380032003000370038003500340039003800620036003500300065003900650036006400360031003100380062006600300064003000620062003200380039006500320034006100300066006400300063003400340061006300650030006400380033003000360035003000660065006100310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000006e12d80e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66656562393738323037383534393862363530653965366436313138626630643062623238396532346130666430633434616365306438333036353066656131000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07af66ee959753ee119d98feac1aa35865e045a29211b9ef448bb64d5290c16b07af66ee959753ee119d98feac1aa35865d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0af101c1-b404-4e7c RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a0cebac2-2a95-4a30 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\feeb97820785498b650e9e6d6118bf0d0bb289e24a0fd0c44ace0d830650fea1" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\72893742-1f38-408a = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e403c5119a1a19da6481718d7408b55b72fd227a951f817a9d5ccf3e2a91e1c1" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\72893742-1f38-408a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f16fa5a2-0fa5-44a6 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e22215e7-c727-4305 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\df7450e1-feec-45db = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\72893742-1f38-408a RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e22215e7-c727-4305 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ee67903000f6d901ee67903000f6d901ee67903000f6d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357f76d2000383065303637333833353435373866666434333536663733353961616436386135663366336431633836313833653165376430633835313564386562333130350000b20009000400efbe4357f76d4357f76d2e0000000000000000000000000000000000000000000000000012050a00380030006500300036003700330038003300350034003500370038006600660064003400330035003600660037003300350039006100610064003600380061003500660033006600330064003100630038003600310038003300650031006500370064003000630038003500310035006400380065006200330031003000350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000006e12d80e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38306530363733383335343537386666643433353666373335396161643638613566336633643163383631383365316537643063383531356438656233313035000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07a866ee959753ee119d98feac1aa35865e045a29211b9ef448bb64d5290c16b07a866ee959753ee119d98feac1aa35865d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\df7450e1-feec-45db = 9ba0ad3000f6d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3a0a435-5112-4336 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\72893742-1f38-408a = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3a0a435-5112-4336 = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\df7450e1-feec-45db = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\98093396-012c-4e12 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\88fe3599-e809-4339 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6519fb-7ac5-4c9d = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\49d7140eedaef14d4d11463ae395dcb52a749ba78463522ad17a4319ee3caa17" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ef915dda-78f6-46d2 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a0cebac2-2a95-4a30 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\41bbe20a-98fd-443a RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d3a0a435-5112-4336 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6519fb-7ac5-4c9d RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\88fe3599-e809-4339 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000cf8db63000f6d901cf8db63000f6d901cf8db63000f6d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357f86d2000383233653531333534363333656164393966366663386239313166663264386436303861333330626663653830653630626562336165396264666163343735380000b20009000400efbe4357f86d4357f86d2e00000000000000000000000000000000000000000000000000310c1501380032003300650035003100330035003400360033003300650061006400390039006600360066006300380062003900310031006600660032006400380064003600300038006100330033003000620066006300650038003000650036003000620065006200330061006500390062006400660061006300340037003500380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000006e12d80e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38323365353133353436333365616439396636666338623931316666326438643630386133333062666365383065363062656233616539626466616334373538000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07ac66ee959753ee119d98feac1aa35865e045a29211b9ef448bb64d5290c16b07ac66ee959753ee119d98feac1aa35865d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a0cebac2-2a95-4a30 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\72893742-1f38-408a = 0f96ae3100f6d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59e59ead-bb3d-4a2e = 4ed9b23000f6d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a0cebac2-2a95-4a30 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\41bbe20a-98fd-443a RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\98093396-012c-4e12 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000002cc8b13000f6d9012cc8b13000f6d9012cc8b13000f6d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004357f86d2000623430333465653035333461653430613531636135303736656564353965303638353338633337396538326637366535636433353431383338363837623137660000b20009000400efbe4357f86d4357f86d2e00000000000000000000000000000000000000000000000000d4d11901620034003000330034006500650030003500330034006100650034003000610035003100630061003500300037003600650065006400350039006500300036003800350033003800630033003700390065003800320066003700360065003500630064003300350034003100380033003800360038003700620031003700660000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000006e12d80e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62343033346565303533346165343061353163613530373665656435396530363835333863333739653832663736653563643335343138333836383762313766000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07ab66ee959753ee119d98feac1aa35865e045a29211b9ef448bb64d5290c16b07ab66ee959753ee119d98feac1aa35865d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\41bbe20a-98fd-443a = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be6519fb-7ac5-4c9d = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\98093396-012c-4e12 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 344 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
client.exepowershell.exeExplorer.EXEpid process 1984 client.exe 1984 client.exe 3260 powershell.exe 3260 powershell.exe 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3140 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 3260 powershell.exe 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 3140 Explorer.EXE 4668 cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 3260 powershell.exe Token: SeShutdownPrivilege 3140 Explorer.EXE Token: SeCreatePagefilePrivilege 3140 Explorer.EXE Token: SeShutdownPrivilege 3140 Explorer.EXE Token: SeCreatePagefilePrivilege 3140 Explorer.EXE Token: SeShutdownPrivilege 3140 Explorer.EXE Token: SeCreatePagefilePrivilege 3140 Explorer.EXE Token: SeShutdownPrivilege 3728 RuntimeBroker.exe Token: SeShutdownPrivilege 3728 RuntimeBroker.exe Token: SeShutdownPrivilege 3140 Explorer.EXE Token: SeCreatePagefilePrivilege 3140 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3140 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3140 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 1688 wrote to memory of 3260 1688 mshta.exe powershell.exe PID 1688 wrote to memory of 3260 1688 mshta.exe powershell.exe PID 3260 wrote to memory of 2100 3260 powershell.exe csc.exe PID 3260 wrote to memory of 2100 3260 powershell.exe csc.exe PID 2100 wrote to memory of 4516 2100 csc.exe cvtres.exe PID 2100 wrote to memory of 4516 2100 csc.exe cvtres.exe PID 3260 wrote to memory of 3556 3260 powershell.exe csc.exe PID 3260 wrote to memory of 3556 3260 powershell.exe csc.exe PID 3556 wrote to memory of 4368 3556 csc.exe cvtres.exe PID 3556 wrote to memory of 4368 3556 csc.exe cvtres.exe PID 3260 wrote to memory of 3140 3260 powershell.exe Explorer.EXE PID 3260 wrote to memory of 3140 3260 powershell.exe Explorer.EXE PID 3260 wrote to memory of 3140 3260 powershell.exe Explorer.EXE PID 3260 wrote to memory of 3140 3260 powershell.exe Explorer.EXE PID 3140 wrote to memory of 3728 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 3728 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 3728 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 3728 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4084 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4084 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4084 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4084 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4896 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4896 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4896 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4896 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 1308 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 1308 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 1308 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 1308 3140 Explorer.EXE RuntimeBroker.exe PID 3140 wrote to memory of 4668 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 4668 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 4668 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 4668 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 4668 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 1980 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 1980 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 1980 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 1980 3140 Explorer.EXE cmd.exe PID 4668 wrote to memory of 344 4668 cmd.exe PING.EXE PID 4668 wrote to memory of 344 4668 cmd.exe PING.EXE PID 4668 wrote to memory of 344 4668 cmd.exe PING.EXE PID 4668 wrote to memory of 344 4668 cmd.exe PING.EXE PID 4668 wrote to memory of 344 4668 cmd.exe PING.EXE PID 3140 wrote to memory of 1980 3140 Explorer.EXE cmd.exe PID 3140 wrote to memory of 1980 3140 Explorer.EXE cmd.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4896
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4084
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 4723⤵
- Program crash
PID:4780 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>K9bn='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(K9bn).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9\\\MemoryLocal'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name eenmgeo -value gp; new-alias -name hbxehnxdf -value iex; hbxehnxdf ([System.Text.Encoding]::ASCII.GetString((eenmgeo "HKCU:Software\AppDataLow\Software\Microsoft\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9").ProcessActive))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zhwxncga\zhwxncga.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8846.tmp" "c:\Users\Admin\AppData\Local\Temp\zhwxncga\CSC425E5014B485449A8BE82E86A9D321A.TMP"5⤵PID:4516
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4hsestzl\4hsestzl.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89AD.tmp" "c:\Users\Admin\AppData\Local\Temp\4hsestzl\CSC8533E1C3F5F34702811C851C3BD6A958.TMP"5⤵PID:4368
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:344 -
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:1980
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:1308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1984 -ip 19841⤵PID:992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4hsestzl\4hsestzl.dllFilesize
3KB
MD5437fedb59c936dd8bb79458df19d4ef1
SHA13a8d722e642cb3f0cbbfb340884d670b5a9e1939
SHA256d3eec5c4a8ec7ae24cb90b8f2d7415c9b950da175b831c171e87673ce9654778
SHA512fbb21b0b6571754be659c1e0950fb84f1b1f8b1700c92131876907d24a22f6278454f95893495e30181886c761baed137fd46450fe1d90b39f6fb99378f2deea
-
C:\Users\Admin\AppData\Local\Temp\RES8846.tmpFilesize
1KB
MD59e11d151c0af759c9099a3625cde300b
SHA14fbcf1c84c2e6c242cd6a906b8e43dc6e9bcd7db
SHA256175fe550dfa70beffea8d47fe1d96d0f6f49de952406ea41534fcba085f16a0b
SHA512b17f7d7e53418a3518d8a498016eada5e6ae41b9cb4546acf0b01df11e157cf722ed68730bfe18153aee08401565c39f653bd4e74e13f053398bee6e2e94e203
-
C:\Users\Admin\AppData\Local\Temp\RES89AD.tmpFilesize
1KB
MD5d2f3312cb862196b759de3031d839bbe
SHA1389ec87104ce0eb23dd6b21dd0b5af4c65c1914a
SHA25638722e90cb0148be304ba798c7198f34c6d5054c57c7ae35c780c1471d9e0deb
SHA5122a75cee19d44079df2304bcf1615e2b4952326848434044d3a35d76d610dac922f1eeb1f809406653391f16673e6e599c6bfaec44d69ce8484ccd4ded8838caa
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2khimpha.2fx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\zhwxncga\zhwxncga.dllFilesize
3KB
MD52282b5652a9fd6370d013058a188336f
SHA13e041278f49c0153a201197631465079ba56ad74
SHA256cfbab90cec0c6073fc47b28726a571b85d5ee555dbea67dec102461a50d7c34d
SHA512e813eb5f9045a852d7ca0b1f2b277a99e298097d5f31ca43507a574cfd54da38ca9443ace125c6ccaa6ffed5d64e2861e6e787f3b2f9dbeaff554c1d93096077
-
\??\c:\Users\Admin\AppData\Local\Temp\4hsestzl\4hsestzl.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\4hsestzl\4hsestzl.cmdlineFilesize
369B
MD5d221a30431a9fbffeb2cf13ed364b3a1
SHA1f19faa285d60805abd43e5a2b90ca50277b0d0e3
SHA2561003db25f55afdda936668825522181d738239d34c3a49cdadb7acc1d1fe69ae
SHA5124ba38ed4ac398846fc7deddde8872c4fb4d836b7ad60f4eeb31e2af9b8f33f021b961d2120940a660d8c13ac358fb69bc5986fa943460f47b36caa5171ddda0d
-
\??\c:\Users\Admin\AppData\Local\Temp\4hsestzl\CSC8533E1C3F5F34702811C851C3BD6A958.TMPFilesize
652B
MD5b3debdebc1a82e5d426c431d13e9a832
SHA12ce3ecd0937721733f7f63e67fa87824b6a21bfa
SHA256be6bb6101faa8780e4acc155e8afc4a7da1c6e5df4a5a5cf0d4e1261226af4ce
SHA512598d06b1cb4b11a67ed0def4ef659c8adb7ffd3e9bb4e2b8aa5e1c06bc36c0f9efd15d88ef83eb7e4beac826e2f9145b1806eec39dbf37e719769c4ea5e533d0
-
\??\c:\Users\Admin\AppData\Local\Temp\zhwxncga\CSC425E5014B485449A8BE82E86A9D321A.TMPFilesize
652B
MD58de02c11cc2fc9c3f65092ec0d68620b
SHA1ffbe82b4606a0b8dc325f0d0fd3d1e6f06a6c2ce
SHA256008613d2f99e23feeb29d03fd06d00fa0b7a54a72a9436b6c1fea61483cd3a47
SHA5124675be742708b464d9edb52e51368ae4620d920e15239523f3ba08b415566f1255d999464d5f46dc36d8c246903efbfe4310201f9fabd04054d8c19334396dc5
-
\??\c:\Users\Admin\AppData\Local\Temp\zhwxncga\zhwxncga.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\zhwxncga\zhwxncga.cmdlineFilesize
369B
MD54ea51599e846831e686f612f4729cddb
SHA170f98cde1bcdb65d328c7170005a69d797125af4
SHA256539401d70d9681d4b4ea04d11549ab7e9aedd54210c770f0cf7e25ab80dc5efe
SHA51210afc73dcff8b8593ed46fee642739765c2b85b96eab19bfa2cc07f520784fa5d29e72a593c5bebfbc8ee0ecf014620d48a9b9f2c06a45b21660bda0b431f8f9
-
memory/344-106-0x0000021AD5DF0000-0x0000021AD5DF1000-memory.dmpFilesize
4KB
-
memory/344-117-0x0000021AD5D40000-0x0000021AD5DE4000-memory.dmpFilesize
656KB
-
memory/344-102-0x0000021AD5D40000-0x0000021AD5DE4000-memory.dmpFilesize
656KB
-
memory/1308-119-0x0000019A00520000-0x0000019A005C4000-memory.dmpFilesize
656KB
-
memory/1308-89-0x0000019A004D0000-0x0000019A004D1000-memory.dmpFilesize
4KB
-
memory/1308-88-0x0000019A00520000-0x0000019A005C4000-memory.dmpFilesize
656KB
-
memory/1980-109-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/1980-103-0x0000000000990000-0x0000000000A28000-memory.dmpFilesize
608KB
-
memory/1980-112-0x0000000000990000-0x0000000000A28000-memory.dmpFilesize
608KB
-
memory/1984-4-0x0000000004030000-0x000000000403D000-memory.dmpFilesize
52KB
-
memory/1984-3-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/1984-7-0x00000000022A0000-0x00000000023A0000-memory.dmpFilesize
1024KB
-
memory/1984-2-0x0000000003FD0000-0x0000000003FDB000-memory.dmpFilesize
44KB
-
memory/1984-114-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/1984-9-0x0000000003FD0000-0x0000000003FDB000-memory.dmpFilesize
44KB
-
memory/1984-1-0x00000000022A0000-0x00000000023A0000-memory.dmpFilesize
1024KB
-
memory/1984-8-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/3140-57-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/3140-95-0x0000000008970000-0x0000000008A14000-memory.dmpFilesize
656KB
-
memory/3140-56-0x0000000008970000-0x0000000008A14000-memory.dmpFilesize
656KB
-
memory/3260-25-0x0000021F26B80000-0x0000021F26B90000-memory.dmpFilesize
64KB
-
memory/3260-54-0x0000021F26B20000-0x0000021F26B5D000-memory.dmpFilesize
244KB
-
memory/3260-22-0x0000021F0E730000-0x0000021F0E752000-memory.dmpFilesize
136KB
-
memory/3260-23-0x00007FFBF3F80000-0x00007FFBF4A41000-memory.dmpFilesize
10.8MB
-
memory/3260-68-0x0000021F26B20000-0x0000021F26B5D000-memory.dmpFilesize
244KB
-
memory/3260-67-0x00007FFBF3F80000-0x00007FFBF4A41000-memory.dmpFilesize
10.8MB
-
memory/3260-24-0x0000021F26B80000-0x0000021F26B90000-memory.dmpFilesize
64KB
-
memory/3260-38-0x0000021F26AF0000-0x0000021F26AF8000-memory.dmpFilesize
32KB
-
memory/3260-52-0x0000021F26B10000-0x0000021F26B18000-memory.dmpFilesize
32KB
-
memory/3728-104-0x0000029337FA0000-0x0000029338044000-memory.dmpFilesize
656KB
-
memory/3728-71-0x0000029338050000-0x0000029338051000-memory.dmpFilesize
4KB
-
memory/3728-70-0x0000029337FA0000-0x0000029338044000-memory.dmpFilesize
656KB
-
memory/4084-77-0x00000223DAD20000-0x00000223DAD21000-memory.dmpFilesize
4KB
-
memory/4084-76-0x00000223DAD60000-0x00000223DAE04000-memory.dmpFilesize
656KB
-
memory/4084-113-0x00000223DAD60000-0x00000223DAE04000-memory.dmpFilesize
656KB
-
memory/4668-98-0x0000021473710000-0x0000021473711000-memory.dmpFilesize
4KB
-
memory/4668-94-0x0000021473660000-0x0000021473704000-memory.dmpFilesize
656KB
-
memory/4668-118-0x0000021473660000-0x0000021473704000-memory.dmpFilesize
656KB
-
memory/4896-116-0x0000020DCD9C0000-0x0000020DCDA64000-memory.dmpFilesize
656KB
-
memory/4896-82-0x0000020DCD9C0000-0x0000020DCDA64000-memory.dmpFilesize
656KB
-
memory/4896-83-0x0000020DCB7C0000-0x0000020DCB7C1000-memory.dmpFilesize
4KB