Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2023 11:58
Static task
static1
Behavioral task
behavioral1
Sample
putty.exe
Resource
win7-20230831-en
General
-
Target
putty.exe
-
Size
293KB
-
MD5
01435632dca9afc151eec77862bfbc2b
-
SHA1
9bbb4ae83131fafcd14d580810b14f48d2d30837
-
SHA256
2adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40
-
SHA512
61e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677
-
SSDEEP
3072:28g/bYYX0XH1anZAsaA6eRESzHxHH3zt8l7Mjd1i0ot:DyYa0XUZdaAnEqHxn3R82i0o
Malware Config
Extracted
gozi
Extracted
gozi
5050
mifrutty.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
mifrutty.com
systemcheck.top
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 1076 set thread context of 3104 1076 powershell.exe Explorer.EXE PID 3104 set thread context of 3804 3104 Explorer.EXE RuntimeBroker.exe PID 3104 set thread context of 4044 3104 Explorer.EXE RuntimeBroker.exe PID 3104 set thread context of 4624 3104 Explorer.EXE RuntimeBroker.exe PID 3104 set thread context of 1932 3104 Explorer.EXE RuntimeBroker.exe PID 3104 set thread context of 2316 3104 Explorer.EXE cmd.exe PID 3104 set thread context of 2252 3104 Explorer.EXE cmd.exe PID 2316 set thread context of 4148 2316 cmd.exe PING.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4700 64 WerFault.exe putty.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3be9be04-2feb-4021 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e34d55768fff1c9db01d63aff5c4eb54a5431f17fa8b9e214dc89c65b94f6934" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24110211-08ce-448b = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9e4a0236-7a16-4ced = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31ec2780-d5c9-478d RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b9262c8-9089-4153 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9e4a0236-7a16-4ced = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9622c033-32bd-4745 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b3a5292904d011b22b8911cbdfc6f842a99f6f0814b738a7235ad3a269e258a4" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9b4c1bf1-e426-4e52 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3be9be04-2feb-4021 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24110211-08ce-448b = 1787dc874cf8d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24110211-08ce-448b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9e4a0236-7a16-4ced RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9622c033-32bd-4745 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e0e8538a4cf8d9010747758a4cf8d9010747758a4cf8d901743806000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657685f2000623361353239323930346430313162323262383931316362646663366638343261393966366630383134623733386137323335616433613236396532353861340000b20009000400efbe4657685f4657685f2e000000000000000000000000000000000000000000000000007c881c00620033006100350032003900320039003000340064003000310031006200320032006200380039003100310063006200640066006300360066003800340032006100390039006600360066003000380031003400620037003300380061003700320033003500610064003300610032003600390065003200350038006100340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be920e381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62336135323932393034643031316232326238393131636264666336663834326139396636663038313462373338613732333561643361323639653235386134000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b073faa0fa69d53ee119d98ead0d487467fe045a29211b9ef448bb64d5290c16b073faa0fa69d53ee119d98ead0d487467fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\faaef70b-55a8-4392 = b89d5d8b4cf8d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9b4c1bf1-e426-4e52 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24110211-08ce-448b = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000005e08c9874cf8d9015e08c9874cf8d9015e08c9874cf8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657695f2000663265383838303231646664353465376132623562646131323635653233613837383736306436353961303065313939633165383230636638333234326139650000b20009000400efbe4657695f4657695f2e00000000000000000000000000000000000000000000000000a2a6fc00660032006500380038003800300032003100640066006400350034006500370061003200620035006200640061003100320036003500650032003300610038003700380037003600300064003600350039006100300030006500310039003900630031006500380032003000630066003800330032003400320061003900650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be920e381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66326538383830323164666435346537613262356264613132363565323361383738373630643635396130306531393963316538323063663833323432613965000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0739aa0fa69d53ee119d98ead0d487467fe045a29211b9ef448bb64d5290c16b0739aa0fa69d53ee119d98ead0d487467fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9e4a0236-7a16-4ced = b7ef2d894cf8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b9262c8-9089-4153 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7273841a-9f7f-48c9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d6c232a0-3c22-48c6 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9e4a0236-7a16-4ced RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\faaef70b-55a8-4392 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3be9be04-2feb-4021 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31ec2780-d5c9-478d = 70fade8a4cf8d901 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31ec2780-d5c9-478d = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000cf153c8a4cf8d9012a0c5b8a4cf8d9012a0c5b8a4cf8d9013d5c03000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657695f2000663265383838303231646664353465376132623562646131323635653233613837383736306436353961303065313939633165383230636638333234326139650000b20009000400efbe4657695f4657695f2e00000000000000000000000000000000000000000000000000a2a6fc00660032006500380038003800300032003100640066006400350034006500370061003200620035006200640061003100320036003500650032003300610038003700380037003600300064003600350039006100300030006500310039003900630031006500380032003000630066003800330032003400320061003900650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be920e381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c66326538383830323164666435346537613262356264613132363565323361383738373630643635396130306531393963316538323063663833323432613965000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b073caa0fa69d53ee119d98ead0d487467fe045a29211b9ef448bb64d5290c16b073caa0fa69d53ee119d98ead0d487467fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7273841a-9f7f-48c9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7273841a-9f7f-48c9 = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bd09ae4c-83de-4f02 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0dc0eff-b6c5-4a85 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3be9be04-2feb-4021 = 64d1c7874cf8d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24110211-08ce-448b RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31ec2780-d5c9-478d = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\faaef70b-55a8-4392 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\faaef70b-55a8-4392 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\faaef70b-55a8-4392 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bd09ae4c-83de-4f02 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bd09ae4c-83de-4f02 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b3a5292904d011b22b8911cbdfc6f842a99f6f0814b738a7235ad3a269e258a4" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0dc0eff-b6c5-4a85 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1c39350f5b83d85cf0fa31118982c42db4252426c3c0dc16d6679b0c0ed2bb17" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b9262c8-9089-4153 = beecf58a4cf8d901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7273841a-9f7f-48c9 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\24110211-08ce-448b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9e4a0236-7a16-4ced = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9e4a0236-7a16-4ced = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000895de2884cf8d9014de30a894cf8d9014de30a894cf8d9011f6703000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657695f2000316333393335306635623833643835636630666133313131383938326334326462343235323432366333633064633136643636373962306330656432626231370000b20009000400efbe4657695f4657695f2e000000000000000000000000000000000000000000000000003c801401310063003300390033003500300066003500620038003300640038003500630066003000660061003300310031003100380039003800320063003400320064006200340032003500320034003200360063003300630030006400630031003600640036003600370039006200300063003000650064003200620062003100370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be920e381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31633339333530663562383364383563663066613331313138393832633432646234323532343236633363306463313664363637396230633065643262623137000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b073baa0fa69d53ee119d98ead0d487467fe045a29211b9ef448bb64d5290c16b073baa0fa69d53ee119d98ead0d487467fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bd09ae4c-83de-4f02 = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d6c232a0-3c22-48c6 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d6c232a0-3c22-48c6 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000091e383874cf8d90191e383874cf8d90191e383874cf8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657685f2000653232636334343134643639333937653039323336336664333131626463623630653230316435373139313732303966363961666230353331363961656565660000b20009000400efbe4657685f4657685f2e000000000000000000000000000000000000000000000000006f9e1000650032003200630063003400340031003400640036003900330039003700650030003900320033003600330066006400330031003100620064006300620036003000650032003000310064003500370031003900310037003200300039006600360039006100660062003000350033003100360039006100650065006500660000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be920e381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c65323263633434313464363933393765303932333633666433313162646362363065323031643537313931373230396636396166623035333136396165656566000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0735aa0fa69d53ee119d98ead0d487467fe045a29211b9ef448bb64d5290c16b0735aa0fa69d53ee119d98ead0d487467fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0dc0eff-b6c5-4a85 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0dc0eff-b6c5-4a85 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c42eb1874cf8d901c42eb1874cf8d901c42eb1874cf8d901000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004657695f2000316333393335306635623833643835636630666133313131383938326334326462343235323432366333633064633136643636373962306330656432626231370000b20009000400efbe4657695f4657695f2e000000000000000000000000000000000000000000000000003c801401310063003300390033003500300066003500620038003300640038003500630066003000660061003300310031003100380039003800320063003400320064006200340032003500320034003200360063003300630030006400630031003600640036003600370039006200300063003000650064003200620062003100370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000be920e381000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31633339333530663562383364383563663066613331313138393832633432646234323532343236633363306463313664363637396230633065643262623137000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b0737aa0fa69d53ee119d98ead0d487467fe045a29211b9ef448bb64d5290c16b0737aa0fa69d53ee119d98ead0d487467fd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31ec2780-d5c9-478d = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\f2e888021dfd54e7a2b5bda1265e23a878760d659a00e199c1e820cf83242a9e" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9622c033-32bd-4745 = 39e3388b4cf8d901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d6c232a0-3c22-48c6 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\faaef70b-55a8-4392 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\faaef70b-55a8-4392 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e34d55768fff1c9db01d63aff5c4eb54a5431f17fa8b9e214dc89c65b94f6934" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d6c232a0-3c22-48c6 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e22cc4414d69397e092363fd311bdcb60e201d571917209f69afb053169aeeef" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0dc0eff-b6c5-4a85 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d6c232a0-3c22-48c6 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7273841a-9f7f-48c9 = e0cd298b4cf8d901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b9262c8-9089-4153 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\e22cc4414d69397e092363fd311bdcb60e201d571917209f69afb053169aeeef" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9622c033-32bd-4745 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9622c033-32bd-4745 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9b4c1bf1-e426-4e52 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d0dc0eff-b6c5-4a85 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\31ec2780-d5c9-478d RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 4148 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
putty.exepowershell.exeExplorer.EXEpid process 64 putty.exe 64 putty.exe 1076 powershell.exe 1076 powershell.exe 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3104 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 1076 powershell.exe 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 3104 Explorer.EXE 2316 cmd.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 1076 powershell.exe Token: SeShutdownPrivilege 3104 Explorer.EXE Token: SeCreatePagefilePrivilege 3104 Explorer.EXE Token: SeShutdownPrivilege 3104 Explorer.EXE Token: SeCreatePagefilePrivilege 3104 Explorer.EXE Token: SeShutdownPrivilege 3104 Explorer.EXE Token: SeCreatePagefilePrivilege 3104 Explorer.EXE Token: SeShutdownPrivilege 3804 RuntimeBroker.exe Token: SeShutdownPrivilege 3104 Explorer.EXE Token: SeCreatePagefilePrivilege 3104 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3104 Explorer.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
RuntimeBroker.exeExplorer.EXEpid process 3804 RuntimeBroker.exe 3104 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 4136 wrote to memory of 1076 4136 mshta.exe powershell.exe PID 4136 wrote to memory of 1076 4136 mshta.exe powershell.exe PID 1076 wrote to memory of 3500 1076 powershell.exe csc.exe PID 1076 wrote to memory of 3500 1076 powershell.exe csc.exe PID 3500 wrote to memory of 2272 3500 csc.exe cvtres.exe PID 3500 wrote to memory of 2272 3500 csc.exe cvtres.exe PID 1076 wrote to memory of 2276 1076 powershell.exe csc.exe PID 1076 wrote to memory of 2276 1076 powershell.exe csc.exe PID 2276 wrote to memory of 1492 2276 csc.exe cvtres.exe PID 2276 wrote to memory of 1492 2276 csc.exe cvtres.exe PID 1076 wrote to memory of 3104 1076 powershell.exe Explorer.EXE PID 1076 wrote to memory of 3104 1076 powershell.exe Explorer.EXE PID 1076 wrote to memory of 3104 1076 powershell.exe Explorer.EXE PID 1076 wrote to memory of 3104 1076 powershell.exe Explorer.EXE PID 3104 wrote to memory of 3804 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 3804 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 3804 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 3804 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4044 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4044 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4044 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4044 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4624 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4624 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4624 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 4624 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 1932 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 1932 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 1932 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 1932 3104 Explorer.EXE RuntimeBroker.exe PID 3104 wrote to memory of 2316 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2316 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2316 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2252 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2252 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2252 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2252 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2316 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2316 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2252 3104 Explorer.EXE cmd.exe PID 3104 wrote to memory of 2252 3104 Explorer.EXE cmd.exe PID 2316 wrote to memory of 4148 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 4148 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 4148 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 4148 2316 cmd.exe PING.EXE PID 2316 wrote to memory of 4148 2316 cmd.exe PING.EXE
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3804
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:1932
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4624
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4044
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\putty.exe"C:\Users\Admin\AppData\Local\Temp\putty.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:64 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 13723⤵
- Program crash
PID:4700 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Lili='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Lili).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9\\\MemoryLocal'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name yaepekrwih -value gp; new-alias -name rfjbix -value iex; rfjbix ([System.Text.Encoding]::ASCII.GetString((yaepekrwih "HKCU:Software\AppDataLow\Software\Microsoft\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9").ProcessActive))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zap45faa\zap45faa.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D49.tmp" "c:\Users\Admin\AppData\Local\Temp\zap45faa\CSC9A4D8F95C19849B8947D9140E4405C2.TMP"5⤵PID:2272
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f4g1fwga\f4g1fwga.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EC0.tmp" "c:\Users\Admin\AppData\Local\Temp\f4g1fwga\CSC4E526A0497CD492286C8D647FEF06BAD.TMP"5⤵PID:1492
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\putty.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:4148 -
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:2252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 64 -ip 641⤵PID:2556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES7D49.tmpFilesize
1KB
MD589843ff5c9eb6261bf7057840ee91a46
SHA1fe32aa7e031ee85601de324869d8459cadd562c0
SHA256f996077dc58fe7c55352003a3a1332270d7010923eb3654d9fad071f18ae49aa
SHA512c56709fc0fb67c6daa6f77c9e4a8c43f236011b56037465d8dcfcb142b940038365d7df662a858f78f86ff3f0ec484b9c2a6073fb142568b6a079c9f09822cbb
-
C:\Users\Admin\AppData\Local\Temp\RES7EC0.tmpFilesize
1KB
MD5aa1df92bd500960b1bbdb45a2b625648
SHA196003c06c39c12937bd221aa353942247e1e54a9
SHA256ee0fa1a1a80a1952ea46893a06f86a7b539652dd897606a112b885725d7c261b
SHA512e99b8cce6437fdc04b85af244eafc71ec24b0f2b69aaad631df83ade21137dc80f188a89f23484660e95b32ff7ba6a3e32405be67fd072dfb47d1b18ad15fe14
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_emf0uqtr.2ts.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\f4g1fwga\f4g1fwga.dllFilesize
3KB
MD5544a73411351808f51fc27fdc57cdc40
SHA104bace750bbda815f3666e9bc5bde6f3d6d044ac
SHA256e8da9d8f46970183ed3a84e723267ee5c942a75d42b9ac5283e0a3812852dbd3
SHA512d9bef2f17a45a9ebb220630cf03e70ffb1cab1df9b80801c9e02cba9ad79372f0061bd4cb6b1d2e6e20516dc08631114238d857a6acfab77d2b7368ba75295ce
-
C:\Users\Admin\AppData\Local\Temp\zap45faa\zap45faa.dllFilesize
3KB
MD5a5923273cf17bbd90a179ea7c243d623
SHA1aec8bb76ee557c3891dce4ed5e2d2e67d85d4ba0
SHA256fefed796b3bd4721841fe790302b6f3a7432b3ddeb81a7a79628ffe3ee909aa9
SHA5122ce4022badcf4c6c2e7e762f49070b382863d9bb0052b3d5199b2d312c2aa994f14437003b02246a43d9da1f7ac65d65a28bb5b11a9715d341f3d8bbf2a2bdb9
-
\??\c:\Users\Admin\AppData\Local\Temp\f4g1fwga\CSC4E526A0497CD492286C8D647FEF06BAD.TMPFilesize
652B
MD5054fc805c06aa5115e54a0d6bbed44cc
SHA100a44b7aa77a4ec09cea72c5fd615375abc26ddf
SHA2560c367c0162cace723c864e40620d42b865059169ddecd8be5c985a9eeed5e1fc
SHA512c21562d4d4b8da7d4cf34157edca5ff3aab74a401e1f865900ebdc4bf4ccc07904a7ad471f742aa5c98d240586bbf299250c44675fe658e0065a7da9fe1969cc
-
\??\c:\Users\Admin\AppData\Local\Temp\f4g1fwga\f4g1fwga.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\f4g1fwga\f4g1fwga.cmdlineFilesize
369B
MD51edfa7b32ff33a3476d14ac6a315b199
SHA1d2171619794787049dd5844fa672b1fa00095f5d
SHA256b0c60526cdd18ecf5fb3e56d6503cd39e668ec30bb1c12d461bdbb0ff62e1284
SHA512cc1ae5beae2dba679b580216652970b6724d8482340bc679b55bf14dfd0accd5cf6dbc4082272ef627ce9f6cec9c1b60beecf664141c31c9770586551b159e38
-
\??\c:\Users\Admin\AppData\Local\Temp\zap45faa\CSC9A4D8F95C19849B8947D9140E4405C2.TMPFilesize
652B
MD5c62cc7d86550bdcc41b4c916122a0567
SHA103afe964d7f6507ab090c598cbb203450bf2d7ac
SHA2562b84fc73c1c3f665857b78eb3dd6df8799db58bbb017d5e41a68ddd6ab51456c
SHA5121c7ed46882a456894ff5701dbbb2479a2d9d196a225cd0b45588305a32f3d01f0e996d4b0126aa03ee8c37b9b49c491dc3bb5048adc77e851615b166eafdcbb2
-
\??\c:\Users\Admin\AppData\Local\Temp\zap45faa\zap45faa.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\zap45faa\zap45faa.cmdlineFilesize
369B
MD5ebc1f34203f63abe65169c34ec159260
SHA1e885056c003b73ff4accd13976a63c086358e0dc
SHA2563494828f665d4ca07ac78c4290e3f59700c6cee840f19c5ccc07fe7854f35490
SHA5123a102b3d791872301cb3815d25c063cc58d03ee6d80f64406986402a7a9fd797947e92a0af5e933fb39f0b7b6a9391e678726b87579f7b2a1d47b6bc95cd1e60
-
memory/64-7-0x0000000002450000-0x0000000002550000-memory.dmpFilesize
1024KB
-
memory/64-1-0x0000000002450000-0x0000000002550000-memory.dmpFilesize
1024KB
-
memory/64-9-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/64-8-0x0000000000400000-0x000000000228F000-memory.dmpFilesize
30.6MB
-
memory/64-4-0x0000000003FF0000-0x0000000003FFD000-memory.dmpFilesize
52KB
-
memory/64-3-0x0000000000400000-0x000000000228F000-memory.dmpFilesize
30.6MB
-
memory/64-2-0x0000000002310000-0x000000000231B000-memory.dmpFilesize
44KB
-
memory/1076-17-0x0000027A53970000-0x0000027A53992000-memory.dmpFilesize
136KB
-
memory/1076-54-0x0000027A53B20000-0x0000027A53B5D000-memory.dmpFilesize
244KB
-
memory/1076-25-0x0000027A53A00000-0x0000027A53A10000-memory.dmpFilesize
64KB
-
memory/1076-24-0x0000027A53A00000-0x0000027A53A10000-memory.dmpFilesize
64KB
-
memory/1076-23-0x0000027A53A00000-0x0000027A53A10000-memory.dmpFilesize
64KB
-
memory/1076-22-0x00007FF8C0590000-0x00007FF8C1051000-memory.dmpFilesize
10.8MB
-
memory/1076-52-0x0000027A53B10000-0x0000027A53B18000-memory.dmpFilesize
32KB
-
memory/1076-38-0x0000027A539E0000-0x0000027A539E8000-memory.dmpFilesize
32KB
-
memory/1076-68-0x0000027A53B20000-0x0000027A53B5D000-memory.dmpFilesize
244KB
-
memory/1076-67-0x00007FF8C0590000-0x00007FF8C1051000-memory.dmpFilesize
10.8MB
-
memory/1932-119-0x000002D460510000-0x000002D4605B4000-memory.dmpFilesize
656KB
-
memory/1932-89-0x000002D460400000-0x000002D460401000-memory.dmpFilesize
4KB
-
memory/1932-88-0x000002D460510000-0x000002D4605B4000-memory.dmpFilesize
656KB
-
memory/2252-105-0x00000000007B0000-0x0000000000848000-memory.dmpFilesize
608KB
-
memory/2252-102-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/2252-98-0x00000000007B0000-0x0000000000848000-memory.dmpFilesize
608KB
-
memory/2316-99-0x0000019E02EA0000-0x0000019E02EA1000-memory.dmpFilesize
4KB
-
memory/2316-118-0x0000019E02DF0000-0x0000019E02E94000-memory.dmpFilesize
656KB
-
memory/2316-95-0x0000019E02DF0000-0x0000019E02E94000-memory.dmpFilesize
656KB
-
memory/3104-57-0x00000000030D0000-0x00000000030D1000-memory.dmpFilesize
4KB
-
memory/3104-56-0x0000000008980000-0x0000000008A24000-memory.dmpFilesize
656KB
-
memory/3104-96-0x0000000008980000-0x0000000008A24000-memory.dmpFilesize
656KB
-
memory/3804-112-0x0000021699A00000-0x0000021699AA4000-memory.dmpFilesize
656KB
-
memory/3804-71-0x0000021699A00000-0x0000021699AA4000-memory.dmpFilesize
656KB
-
memory/3804-70-0x0000021699790000-0x0000021699791000-memory.dmpFilesize
4KB
-
memory/4044-75-0x0000023BC2AA0000-0x0000023BC2B44000-memory.dmpFilesize
656KB
-
memory/4044-116-0x0000023BC2AA0000-0x0000023BC2B44000-memory.dmpFilesize
656KB
-
memory/4044-76-0x0000023BC2A60000-0x0000023BC2A61000-memory.dmpFilesize
4KB
-
memory/4148-107-0x0000025FE1360000-0x0000025FE1404000-memory.dmpFilesize
656KB
-
memory/4148-113-0x0000025FE1510000-0x0000025FE1511000-memory.dmpFilesize
4KB
-
memory/4148-114-0x0000025FE1360000-0x0000025FE1404000-memory.dmpFilesize
656KB
-
memory/4624-81-0x000001AB5E160000-0x000001AB5E204000-memory.dmpFilesize
656KB
-
memory/4624-117-0x000001AB5E160000-0x000001AB5E204000-memory.dmpFilesize
656KB
-
memory/4624-83-0x000001AB5DF50000-0x000001AB5DF51000-memory.dmpFilesize
4KB