tinba | f5b54e523658d3a16409ecb3ec7c69f0c242411231a8edbdfcfddaa55f115f5e

Analysis

max time kernel
154s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b3dc736c4bd26163426997a44768bac.exe
Size 160KB
Sample240114-pp6dlaaadp
SHA256 f5b54e523658d3a16409ecb3ec7c69f0c242411231a8edbdfcfddaa55f115f5e
MD5 5b3dc736c4bd26163426997a44768bac
SHA1 4928cfe2993b1af5c606c9f4c04b42a4191afc24
SHA512 13a2d877a18ab475081672812dbca2431262adfbcb385f4ced105edc3d217df276a7718a42ae343422b8abc4a64fde51cc4e33ddb0327b0cba47ab40ee5df751
SSDEEP 1536:DEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:AY+4MiIkLZJNAQ9J6v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4888-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F028C068 = "C:\\Users\\Admin\\AppData\\Roaming\\F028C068\\bin.exe"	winver.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d- = db7f30e6e546da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee- = 212d35e6e546da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000be1a0ce6e546da01be1a0ce6e546da01be1a0ce6e546da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000002e5834642000646463386330643830613438373834333966666563333862653039396136636562313861353030303837623939663236393937353864323731373361373463360000b20009000400efbe2e5834642e5834642e0000000000000000000000000000000000000000000000000042cf1401640064006300380063003000640038003000610034003800370038003400330039006600660065006300330038006200650030003900390061003600630065006200310038006100350030003000300038003700620039003900660032003600390039003700350038006400320037003100370033006100370034006300360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000002f9079911000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64646338633064383061343837383433396666656333386265303939613663656231386135303030383762393966323639393735386432373137336137346336000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef50ae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef50ae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\4714c674c46df23fdd497d48357705e9f785cfd1ce68aecc2b627220b65f8119"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000d944d5e5e546da01d944d5e5e546da01d944d5e5e546da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000002e5833642000333464623664626163303238326165316362306339643037616238316533333534646239666361396663643236396130316233666166316638646662326539640000b20009000400efbe2e5833642e5833642e0000000000000000000000000000000000000000000000000027781a00330034006400620036006400620061006300300032003800320061006500310063006200300063003900640030003700610062003800310065003300330035003400640062003900660063006100390066006300640032003600390061003000310062003300660061006600310066003800640066006200320065003900640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000002f9079911000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33346462366462616330323832616531636230633964303761623831653333353464623966636139666364323639613031623366616631663864666232653964000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef4eae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef4eae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000b5cefde5e546da01b5cefde5e546da01b5cefde5e546da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000002e5834642000353134313138396131326464343265366439326563303337356566366539393637663537643330343332633261663530623333353433303539343233313564370000b20009000400efbe2e5834642e5834642e000000000000000000000000000000000000000000000000004b1b2301350031003400310031003800390061003100320064006400340032006500360064003900320065006300300033003700350065006600360065003900390036003700660035003700640033003000340033003200630032006100660035003000620033003300350034003300300035003900340032003300310035006400370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000002f9079911000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c35313431313839613132646434326536643932656330333735656636653939363766353764333034333263326166353062333335343330353934323331356437000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef4fae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef4fae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000025de2fe6e546da0125de2fe6e546da0125de2fe6e546da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000002e5834642000646234333230623165356234626163336230363361383764383333356164363335623737363133376335396462336331636361653037303432663337356333380000b20009000400efbe2e5834642e5834642e00000000000000000000000000000000000000000000000000db0bf100640062003400330032003000620031006500350062003400620061006300330062003000360033006100380037006400380033003300350061006400360033003500620037003700360031003300370063003500390064006200330063003100630063006100650030003700300034003200660033003700350063003300380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000002f9079911000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64623433323062316535623462616333623036336138376438333335616436333562373736313337633539646233633163636165303730343266333735633338000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef53ae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef53ae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510- = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000385626e6e546da01385626e6e546da01385626e6e546da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000002e5834642000613032626235643038356363323461333261313738396461346566313538666663663335303762336631316462656662343334383062306662643135623565300000b20009000400efbe2e5834642e5834642e00000000000000000000000000000000000000000000000000c893fa00610030003200620062003500640030003800350063006300320034006100330032006100310037003800390064006100340065006600310035003800660066006300660033003500300037006200330066003100310064006200650066006200340033003400380030006200300066006200640031003500620035006500300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000002f9079911000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61303262623564303835636332346133326131373839646134656631353866666366333530376233663131646265666234333438306230666264313562356530000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef52ae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef52ae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee- = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863- = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000160818e6e546da01160818e6e546da01160818e6e546da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad013200000000002e5834642000343731346336373463343664663233666464343937643438333537373035653966373835636664316365363861656363326236323732323062363566383131390000b20009000400efbe2e5834642e5834642e00000000000000000000000000000000000000000000000000eae10801340037003100340063003600370034006300340036006400660032003300660064006400340039003700640034003800330035003700370030003500650039006600370038003500630066006400310063006500360038006100650063006300320062003600320037003200320030006200360035006600380031003100390000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000002f9079911000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34373134633637346334366466323366646434393764343833353737303565396637383563666431636536386165636332623632373232306236356638313139000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e75706e73766d6c0000000000000000d64d8dc67fb7c6409496e84bb242f8ef51ae8e85389bee11b6adf21ab124c203d64d8dc67fb7c6409496e84bb242f8ef51ae8e85389bee11b6adf21ab124c203ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0033003000370033003100390031003600380030002d003400330035003800360035003300310034002d0032003800360032003700380034003900310035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000003462af57000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee- = "8324"	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e50c16c8-1951-4f4b-	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8- = a6a5e4e5e546da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863- = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ddc8c0d80a4878439ffec38be099a6ceb18a500087b99f2699758d27173a74c6"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\34db6dbac0282ae1cb0c9d07ab81e3354db9fca9fcd269a01b3faf1f8dfb2e9d"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665-	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8- = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510- = 89c70ae6e546da01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510- = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9eeee98-1a42-4863- = 8e1f16e6e546da01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\bde34947-4313-4665- = aea426e6e546da01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d-	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d4129b54-952a-4eb8- = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8080d3d8-295a-4cee- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\db4320b1e5b4bac3b063a87d8335ad635b776137c59db3c1ccae07042f375c38"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d- = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b265513-7afb-4510- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\5141189a12dd42e6d92ec0375ef6e9967f57d30432c2af50b3354305942315d7"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6d88ab02-8c54-4d8d- = "\\\\?\\Volume{57AF6234-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a02bb5d085cc24a32a1789da4ef158ffcf3507b3f11dbefb43480b0fbd15b5e0"	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe
3988	winver.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeShutdownPrivilege	952	RuntimeBroker.exe
Token: SeDebugPrivilege	3904	backgroundTaskHost.exe
Token: SeDebugPrivilege	3904	backgroundTaskHost.exe
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3988	winver.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3520	Explorer.EXE
4028	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3988	4888	5b3dc736c4bd26163426997a44768bac.exe	88
PID 4888 wrote to memory of 3988	4888	5b3dc736c4bd26163426997a44768bac.exe	88
PID 4888 wrote to memory of 3988	4888	5b3dc736c4bd26163426997a44768bac.exe	88
PID 4888 wrote to memory of 3988	4888	5b3dc736c4bd26163426997a44768bac.exe	88
PID 3988 wrote to memory of 3520	3988	winver.exe	29
PID 3988 wrote to memory of 2472	3988	winver.exe	43
PID 3988 wrote to memory of 2484	3988	winver.exe	42
PID 3988 wrote to memory of 2620	3988	winver.exe	41
PID 3988 wrote to memory of 3520	3988	winver.exe	29
PID 3988 wrote to memory of 3680	3988	winver.exe	28
PID 3988 wrote to memory of 3932	3988	winver.exe	27
PID 3988 wrote to memory of 4028	3988	winver.exe	26
PID 3988 wrote to memory of 952	3988	winver.exe	25
PID 3988 wrote to memory of 3172	3988	winver.exe	24
PID 3988 wrote to memory of 3532	3988	winver.exe	23
PID 3988 wrote to memory of 1880	3988	winver.exe	21
PID 3988 wrote to memory of 4824	3988	winver.exe	11
PID 3988 wrote to memory of 4316	3988	winver.exe	5
PID 3988 wrote to memory of 3216	3988	winver.exe	85
PID 3988 wrote to memory of 1168	3988	winver.exe	87
PID 3988 wrote to memory of 4988	3988	winver.exe	91
PID 3988 wrote to memory of 3164	3988	winver.exe	100
PID 3988 wrote to memory of 4376	3988	winver.exe	101
PID 3988 wrote to memory of 4796	3988	winver.exe	102
PID 3988 wrote to memory of 4588	3988	winver.exe	103
PID 3988 wrote to memory of 876	3988	winver.exe	108
PID 3988 wrote to memory of 3152	3988	winver.exe	109
PID 3988 wrote to memory of 3904	3988	winver.exe	114
PID 3988 wrote to memory of 1332	3988	winver.exe	116
PID 3988 wrote to memory of 4900	3988	winver.exe	117
PID 3988 wrote to memory of 1176	3988	winver.exe	119
PID 3988 wrote to memory of 4880	3988	winver.exe	120
PID 3988 wrote to memory of 4780	3988	winver.exe	126
PID 3988 wrote to memory of 564	3988	winver.exe	127
PID 3988 wrote to memory of 3400	3988	winver.exe	132
PID 3988 wrote to memory of 3488	3988	winver.exe	133
PID 3988 wrote to memory of 4344	3988	winver.exe	134
PID 3988 wrote to memory of 2444	3988	winver.exe	139
PID 3988 wrote to memory of 3928	3988	winver.exe	140

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4316

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4824

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3532

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3172

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of UnmapMainImage
PID:4028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3932 -s 956
  2⤵
  PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3520
- C:\Users\Admin\AppData\Local\Temp\5b3dc736c4bd26163426997a44768bac.exe
  "C:\Users\Admin\AppData\Local\Temp\5b3dc736c4bd26163426997a44768bac.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3988

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2484

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2472

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1168

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3164

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Modifies registry class
PID:4376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:4796

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:876

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3152

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1332

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1176

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4880

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:4780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:564

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3400

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3488

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2444

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6d88ab02-8c54-4d8d-a7f1-ba171123152d.down_data

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6d88ab02-8c54-4d8d-a7f1-ba171123152d.down_data
Size 280KB
SHA256 432ecd9d0c86f02955bdecd7ed85c1b2e7d44ff82285e063e75c1a6e88ced5e4
MD5 40221fce3d4b3877ffb93cb46ad80f4a
SHA1 d564738010e3c315887406428e92bf394f84b817
SHA512 d23b32bf4553a2594a1a7d78a5cd559f9c6076452ec5d7357d28eaf71b5c320d4b7b3820460b53877deb6ac2ffb158a687776dd740b81fd7abe13910d0d26747
SSDEEP 6144:wsRxkQOze5ZyDRHrdIKcLB2lPuj26f8AlUl09ejpvayNTAMTZW2apI:PRxkQSVHyK2UW8AlcM4CySMT02a+
MD5 SHA1 SHA512 SSDEEP

Submit Download

8080d3d8-295a-4cee-b0ff-6e4e49165f96.down_data

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8080d3d8-295a-4cee-b0ff-6e4e49165f96.down_data
Size 336KB
SHA256 36619dc871fc504dd892d63601a5cbeb01b9a2d699920524c0ef27a92aa25dff
MD5 e4454b5ca07094d2b049de667ca8f62a
SHA1 4c2e64df7c74eacdb94508a3da385ac9c343c975
SHA512 676bb301e726947c92b9ee3116e3df1422bf5bb5464029f291ffd114920c3f42d51039d8f4ba426919e456338162f2205b38a44f14411352351030230fa46e77
SSDEEP 6144:drsJMT8VJ9JDscbTtLM7TGa3y7VLttSP+6q//8JTQBJFmX7Albizg1pGK:5A7DsUtLwGa3yZLttf6zUlbizg1QK
MD5 SHA1 SHA512 SSDEEP

Submit Download

1705235614

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280815\1705235614
Size 6KB
SHA256 7e59f709384cbaf9dfc61450f0aa61c19a41f710ba4414aa403077907cf7a607
MD5 8da7f1cfe52e909f606bbdb5544c6235
SHA1 85e2e6cf8b87746677c656d9e5f5d7ec2ea3ff66
SHA512 207a9795be2c1d32668bc756d2e204d9085c85fc76554e7d001b5a52d3935adfae9f389b81fe2275ff9b495f7bab6496a33116581845a53ad5356e7ef8ed4e09
SSDEEP 96:LcTcgyaWbk4btWfdGg+X7YUmQ1k4brj6X/cUmQIJBU3DkbAJb7d62FupwatWDB5/:Lv44wFGgXr4XmXuyzkbi9tqVtcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

1705235615

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1705235615
Size 43KB
SHA256 895f7244fb67e3afdd3f934e9c89a0d0744f1073f11c895e6a20934ce32e6f96
MD5 4bda670af088394eb8c781ebaa0d19dd
SHA1 db48cb421922c48325e0f754334636a450c1aeaa
SHA512 a8c75cabb3553ff7a072ef62cf058a941d78164aea3ef4d461bae3ce4d1d6f7bb8be395ac8cbfe8778e4881c519591bf92a3d1cc26199cd56cb5345f2b13cde3
SSDEEP 384:L/JOT58hFJOTPPQJOTVj9/e8Kz49tSFmKYpFmMWKjFm3:0OhOFV5JS8Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 213B
SHA256 5c8dcf38d97e9c8bb976599b32665ef5e480c62fcbcae0c2e15bf776f87d639f
MD5 86f1ac9e9b42364d6b887e2f35f06cc3
SHA1 a835f8329ff7588d5794c3c6ee88bafc4e61ad2b
SHA512 8d5013f252e000966af48df220a5d2ac0f5df552667cc2a9f7214339e3624c623f96f3cdf93be240a2c9cfcab315abdd45ce8f4cc65352cf45b2915aa95875e8
MD5 SHA1 SHA512

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 416B
SHA256 054562d68cb001ba367b0106ec554eeaa2c0e843d63894044d7c59859b1c86a4
MD5 d252e7d9541f3f4d8c916c32971c7999
SHA1 8efacf929d064027f112a19e27313e444dc242fe
SHA512 26d14680fa1c34c4665f95c93d8224d41952d42113f642d97276455a134779bc4c93f0403942c58af23c83e627491799fb1b19724d589e5e91bf53838754a765
MD5 SHA1 SHA512

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 629B
SHA256 db83e268e407e42fa4dbeeeaf20716bb18ff2404c17fcc35688b2177a5382047
MD5 ae929d608d6da1a7ddcdc563276c8409
SHA1 b5453f6d43f449f0ab83bfad9a31787e7700a658
SHA512 3538a895203eed53a99f899b94ba9731b9ac0b1494e97fc38b2b1af73fc4d22c73237976a1f629c742d0b4d6b44688d8d022aa5b1a189c682631beb190833c00
MD5 SHA1 SHA512

Submit Download

1705235578

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1705235578
Size 6KB
SHA256 2ce4c1d88a8905fefe9181e9459c73ba284ccdadd024b0869dd0c69ec94950c7
MD5 b27b8fd743407f67069ee3a67b502721
SHA1 b7daf424b544bd14e734b478cea5deceaff4087c
SHA512 d301379c7432be3e214abf8f0740edc76bf6a7e82aff08d50f9b5eff5fd9ade9d45189b30fe6364a140b098ea852dc71dfd5eadaa1e6d64316f519480ac2abee
SSDEEP 96:LcTcgyaWbk4btWfdGEUIS1+UmQdk4brjXUzrHXUnUmQqBUXDkbTJb7VG62opwarx:Lv44wFGEjfj4XDIr304Tkb91GtWVXd
MD5 SHA1 SHA512 SSDEEP

Submit Download

1705235614

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\88000045\1705235614
Size 6KB
SHA256 34064e5629d45b6ada587342893c690c24750cd2f060766a17027a53ce0ff160
MD5 b18e1a258b9cb8ff51ffcd335fe07e74
SHA1 be457fae0f9ade739d262c555ba07305eb683856
SHA512 b811a2b91b464bd78d9a51b3577ec5b961362db3b665223e0143f118788397ca531436ad08bb929a54535706d48cb384d3df771a77b7a4a1be82a1e66c35e1db
SSDEEP 192:Lv44wFGEM+V74XD3gGPdnba6kbi9t9Vtcn:L6Wzfmy9Vmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

64104820682d4fe194f026719f8d704d_1

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\64104820682d4fe194f026719f8d704d_1
Size 1KB
SHA256 05335c5b9a7435fc81e4150e9a395ed552825180bbadf5a8bcd77aaa53560075
MD5 800a3498182c3dce735c7ef5dc27197f
SHA1 30a09251502699d13f4579e127eeefb2741086ba
SHA512 d3b192c1b14bcf96ee02d2d4a73e6477087862ae79ffaf5a012357f574a72e9045ce06978f2fbfa953bbc4d16763af2d92ca5bf1a80850efd055fcd504476318
MD5 SHA1 SHA512

Submit Download

memory/564-193-0x0000000000960000-0x0000000000966000-memory.dmp

Download

memory/876-105-0x00000000004F0000-0x00000000004F6000-memory.dmp

Download

memory/952-30-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Download

memory/952-92-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/952-90-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/952-26-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Download

memory/952-91-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/1168-37-0x0000000000890000-0x0000000000896000-memory.dmp

Download

memory/1168-40-0x0000000000890000-0x0000000000896000-memory.dmp

Download

memory/1168-58-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/1168-61-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/1176-180-0x0000000000830000-0x0000000000836000-memory.dmp

Download

memory/1332-128-0x0000000000D10000-0x0000000000D16000-memory.dmp

Download

memory/1332-126-0x0000000000D10000-0x0000000000D16000-memory.dmp

Download

memory/1880-31-0x00000000000D0000-0x00000000000D6000-memory.dmp

Download

memory/1880-36-0x00000000000D0000-0x00000000000D6000-memory.dmp

Download

memory/2472-175-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/2472-17-0x0000000000430000-0x0000000000436000-memory.dmp

Download

memory/2484-15-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2484-18-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2620-23-0x0000000000C30000-0x0000000000C36000-memory.dmp

Download

memory/2620-16-0x0000000000C30000-0x0000000000C36000-memory.dmp

Download

memory/3152-106-0x0000000000BD0000-0x0000000000BD6000-memory.dmp

Download

memory/3164-63-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/3164-60-0x0000000000B90000-0x0000000000B96000-memory.dmp

Download

memory/3164-62-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/3164-59-0x0000000000B90000-0x0000000000B96000-memory.dmp

Download

memory/3172-27-0x0000000000940000-0x0000000000946000-memory.dmp

Download

memory/3216-39-0x0000000000D20000-0x0000000000D26000-memory.dmp

Download

memory/3216-34-0x0000000000D20000-0x0000000000D26000-memory.dmp

Download

memory/3400-239-0x0000000000010000-0x0000000000016000-memory.dmp

Download

memory/3400-209-0x0000000000010000-0x0000000000016000-memory.dmp

Download

memory/3400-206-0x0000000000010000-0x0000000000016000-memory.dmp

Download

memory/3488-207-0x00000000007B0000-0x00000000007B6000-memory.dmp

Download

memory/3520-9-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/3520-8-0x00007FFE508ED000-0x00007FFE508EE000-memory.dmp

Download

memory/3520-19-0x00000000008E0000-0x00000000008E6000-memory.dmp

Download

memory/3520-100-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/3520-6-0x00000000025F0000-0x00000000025F6000-memory.dmp

Download

memory/3520-21-0x00000000008E0000-0x00000000008E6000-memory.dmp

Download

memory/3532-28-0x00000000008D0000-0x00000000008D6000-memory.dmp

Download

memory/3532-35-0x00000000008D0000-0x00000000008D6000-memory.dmp

Download

memory/3680-25-0x0000000000C70000-0x0000000000C76000-memory.dmp

Download

memory/3680-20-0x0000000000C70000-0x0000000000C76000-memory.dmp

Download

memory/3904-202-0x00000000000F0000-0x00000000000F6000-memory.dmp

Download

memory/3904-130-0x00000000000F0000-0x00000000000F6000-memory.dmp

Download

memory/3904-139-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/3904-125-0x00000000000F0000-0x00000000000F6000-memory.dmp

Download

memory/3904-131-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/3932-22-0x0000000000500000-0x0000000000506000-memory.dmp

Download

memory/3988-7-0x0000000076FD2000-0x0000000076FD3000-memory.dmp

Download

memory/3988-3-0x0000000000D20000-0x0000000000D32000-memory.dmp

Download

memory/3988-4-0x00000000013E0000-0x00000000013E6000-memory.dmp

Download

memory/3988-13-0x00000000013E0000-0x00000000013E6000-memory.dmp

Download

memory/4028-64-0x00007FFE50A60000-0x00007FFE50A61000-memory.dmp

Download

memory/4028-24-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Download

memory/4028-29-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Download

memory/4028-94-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/4316-43-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/4316-42-0x00007FFE508EC000-0x00007FFE508ED000-memory.dmp

Download

memory/4316-33-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

Download

memory/4316-41-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

Download

memory/4344-208-0x0000000000AF0000-0x0000000000AF6000-memory.dmp

Download

memory/4376-103-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download

memory/4376-113-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/4376-95-0x0000000000650000-0x0000000000656000-memory.dmp

Download

memory/4376-96-0x0000000000650000-0x0000000000656000-memory.dmp

Download

memory/4376-97-0x00007FFE508ED000-0x00007FFE508EE000-memory.dmp

Download

memory/4376-104-0x0000000000650000-0x0000000000656000-memory.dmp

Download

memory/4588-99-0x00000000009F0000-0x00000000009F6000-memory.dmp

Download

memory/4780-192-0x00000000007E0000-0x00000000007E6000-memory.dmp

Download

memory/4796-98-0x0000000000990000-0x0000000000996000-memory.dmp

Download

memory/4824-38-0x0000000000E20000-0x0000000000E26000-memory.dmp

Download

memory/4824-32-0x0000000000E20000-0x0000000000E26000-memory.dmp

Download

memory/4880-181-0x0000000000240000-0x0000000000246000-memory.dmp

Download

memory/4888-10-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4888-11-0x0000000002320000-0x0000000002D20000-memory.dmp

Download

memory/4888-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4888-2-0x0000000002320000-0x0000000002D20000-memory.dmp

Download

memory/4888-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/4900-127-0x0000000000E00000-0x0000000000E06000-memory.dmp

Download

memory/4900-129-0x0000000000E00000-0x0000000000E06000-memory.dmp

Download

memory/4900-137-0x00007FFE50A80000-0x00007FFE50A81000-memory.dmp

Download

memory/4900-184-0x00007FFE50A70000-0x00007FFE50A71000-memory.dmp

Download