Malware Analysis Report

2025-05-28 14:51

Sample ID 221219-l3ydcshg9x
Target d4fe627b0bc66a57bfdb76c531c06ce6.exe
SHA256 9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97
Tags
danabot banker discovery persistence spyware stealer trojan collection
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97

Threat Level: Known bad

The file d4fe627b0bc66a57bfdb76c531c06ce6.exe was found to be: Known bad.

Malicious Activity Summary

danabot banker discovery persistence spyware stealer trojan collection

Danabot

Sets DLL path for service in the registry

Blocklisted process makes network request

Sets service image path in registry

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses Microsoft Outlook accounts

Drops desktop.ini file(s)

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Enumerates physical storage devices

Checks processor information in registry

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Suspicious use of FindShellTrayWindow

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-12-19 10:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-12-19 10:04

Reported

2022-12-19 10:06

Platform

win7-20221111-en

Max time kernel

119s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SYMBOL\Parameters\ServiceDll = "C:\\Program Files (x86)\\Windows Media Player\\en-US\\SYMBOL.dll" C:\Windows\SysWOW64\rundll32.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SYMBOL\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Desktop.ini C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Desktop.ini C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1284 set thread context of 1608 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\brt.fca C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\template.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\MinionPro-BoldIt.otf C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\CP1252.TXT C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\CourierStd-Oblique.otf C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\EQNEDT32.CNT C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\review_same_reviewers.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\MCIMPP.mpp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\VDK10.STD C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\ccme_base.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\Dynamic.pdf C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\Identity-H C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\PDFFile_8.ico C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\SYMBOL.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\cryptocme2.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\SaslPrepProfile_norm_bidi.spp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\Thawte Root Certificate.cer C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\DW20.EXE C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\AcroTextExtractor.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\Adobe Root Certificate.cer C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID C:\Windows\SysWOW64\svchost.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\system32\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1424 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe C:\Windows\SysWOW64\rundll32.exe
PID 1424 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe C:\Windows\SysWOW64\rundll32.exe
PID 1424 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe C:\Windows\SysWOW64\rundll32.exe
PID 1424 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe C:\Windows\SysWOW64\rundll32.exe
PID 1424 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe C:\Windows\SysWOW64\rundll32.exe
PID 1424 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe C:\Windows\SysWOW64\rundll32.exe
PID 1424 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe C:\Windows\SysWOW64\rundll32.exe
PID 1284 wrote to memory of 1608 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1284 wrote to memory of 1608 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1284 wrote to memory of 1608 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1284 wrote to memory of 1608 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1284 wrote to memory of 1608 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe

"C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23994

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows media player\en-us\symbol.dll",r1ZZTA==

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

C:\Windows\SysWOW64\schtasks.exe

schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 127.0.0.1:23994 tcp
N/A 127.0.0.1:1312 tcp
N/A 23.236.181.126:443 tcp
N/A 127.0.0.1:23994 tcp
N/A 197.67.48.107:443 tcp

Files

memory/1424-54-0x0000000001DD0000-0x0000000001EA6000-memory.dmp

memory/1424-55-0x0000000075831000-0x0000000075833000-memory.dmp

memory/1284-56-0x0000000000000000-mapping.dmp

memory/1424-57-0x0000000001DD0000-0x0000000001EA6000-memory.dmp

memory/1424-58-0x0000000001EB0000-0x0000000001FC5000-memory.dmp

memory/1424-60-0x0000000000400000-0x0000000000517000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

memory/1284-63-0x00000000042C0000-0x00000000049E5000-memory.dmp

memory/1284-65-0x00000000042C0000-0x00000000049E5000-memory.dmp

memory/1284-66-0x00000000049F0000-0x0000000004B30000-memory.dmp

memory/1284-67-0x00000000049F0000-0x0000000004B30000-memory.dmp

memory/1284-68-0x00000000042C0000-0x00000000049E5000-memory.dmp

memory/1284-69-0x0000000004C30000-0x0000000004D70000-memory.dmp

memory/1608-70-0x0000000000260000-0x0000000000479000-memory.dmp

memory/1284-72-0x0000000004C30000-0x0000000004D70000-memory.dmp

memory/1284-74-0x00000000049F0000-0x0000000004B30000-memory.dmp

memory/1608-75-0x00000000FFED3CEC-mapping.dmp

memory/1284-73-0x00000000049F0000-0x0000000004B30000-memory.dmp

memory/1608-77-0x0000000001E00000-0x0000000001F40000-memory.dmp

memory/1608-76-0x0000000001E00000-0x0000000001F40000-memory.dmp

memory/1608-78-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

memory/1608-80-0x0000000002010000-0x000000000223A000-memory.dmp

memory/1608-79-0x0000000000260000-0x0000000000479000-memory.dmp

memory/1284-81-0x00000000042C0000-0x00000000049E5000-memory.dmp

\??\c:\program files (x86)\windows media player\en-us\symbol.dll

MD5 e34351821762100fd33463fffbe7a0ae
SHA1 d12dda8fd686c35202f00bd83a745a06289e7536
SHA256 0b00ba5c15e8845bdef32b580607fac20908e07f194a99b66f7f2eb1a987c1ad
SHA512 d89f34e78b1320c4e4829c0e88f0dd8d6188e8a305527b224a818710edba08d51dcf187757b236239140e22d5092b0d62fec338dd8202b10a3e8b35d60dd784a

\Program Files (x86)\Windows Media Player\en-US\SYMBOL.dll

MD5 e34351821762100fd33463fffbe7a0ae
SHA1 d12dda8fd686c35202f00bd83a745a06289e7536
SHA256 0b00ba5c15e8845bdef32b580607fac20908e07f194a99b66f7f2eb1a987c1ad
SHA512 d89f34e78b1320c4e4829c0e88f0dd8d6188e8a305527b224a818710edba08d51dcf187757b236239140e22d5092b0d62fec338dd8202b10a3e8b35d60dd784a

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 7232474e7c3b7c2f30a4f020ca8544d8
SHA1 120a84c032eca72029f8189e51320ea55a10d10a
SHA256 e5efd8da158f04cb809a6a107e5ba077f1281255f394826e9890ecdee0187a44
SHA512 b073fac844387ec3444f8f190311f0887492bbb8a418341599ccd882e5bbc6aee046db12c87716313335eaa5f626cbe535f940ef1187f13e270e17c7466cbee6

memory/1916-86-0x00000000039B0000-0x00000000040D5000-memory.dmp

memory/1916-88-0x00000000039B0000-0x00000000040D5000-memory.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\print_property.ico

MD5 30d7062e069bc0a9b34f4034090c1aae
SHA1 e5fcedd8e4cc0463c0bc6912b1791f2876e28a61
SHA256 24e77f244b0743e311b0fc97f06513a0cecf6560e92f9c6f164288a152d32000
SHA512 85dd6c916d48804a24dbbad0f4b4842453ac31a692905f8f2f34112eaa1bbf062a825d45ed5d800bbc4663a28b0b5003ebd5fa54991cf846f1028e929ea06de6

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\ONINTL.REST.trx_dll

MD5 9166ad55769791fe3a6ed688f114ad1e
SHA1 ae83ff5266d6a691e78ffb2a32378cc08014d693
SHA256 4423ed91253d2f07dcbdfc68ff88bd85f08aee00c98eba138b946b934139c490
SHA512 8dd251ee0457276f013f195f2ae4f173e33cd9d358ba3066e8fbc4472badbd4541b367bd192cb58a8644a05f928626653a67fc951b4e0f9020363a499f177356

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 7232474e7c3b7c2f30a4f020ca8544d8
SHA1 120a84c032eca72029f8189e51320ea55a10d10a
SHA256 e5efd8da158f04cb809a6a107e5ba077f1281255f394826e9890ecdee0187a44
SHA512 b073fac844387ec3444f8f190311f0887492bbb8a418341599ccd882e5bbc6aee046db12c87716313335eaa5f626cbe535f940ef1187f13e270e17c7466cbee6

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\AssetLibrary.ico

MD5 ca98ea80630e3f5f0dd4ab39bd25ffb5
SHA1 3fbfc2f0aea9875245631ff84ea912b2acf5c9d1
SHA256 5d8e1d9c9d7d8a54b35b9dc70224e6d6fa19518977492b92d54f98ace9efc7a1
SHA512 6b1fc477b7a74154eb654692c0ddee811bb48ccfd119ae9f8c85f5ca1d1f992308264ffb8e7303590fe2f212043028ddee7c0052ff10f6349caec83567a93507

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Desktop.ini

MD5 2db341606a8d0e39c81a95a64ed33c84
SHA1 fe436d05231e70928a5acb556d6b8b3ef3260fd6
SHA256 01a69ba309c6665e612654e9d4d6b081772083dd3b9bb657c5123f02233e775a
SHA512 ef9ae495413e6dd72ada2148dd8da69542229d2fccb7e717ca488ac8ca7a5653c8a5075e0ba43eb735d37f16c416a26b0ec5db38438f2463724e219f19c51d96

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Help_CValidator.H1D

MD5 15df0c4efe61e89ac34133dffde48d75
SHA1 be9773dbefb06cf48b46ec76831c0680f5375cc7
SHA256 88f9c30ea167b52d97189e8dc344bc0640f2ad8cac5d63c1434b4c3df4053c07
SHA512 4e3f1e3876b4618616a3a98e322ba5abf4304d505790e2231abb78adadc25aa3367da6b8cd64f79b71eb2517f5853736506ea5a3652a0fdee5015352e0799175

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Help_MKWD_AssetId.H1W

MD5 75b592d072f1406ee14771c8b3732e56
SHA1 3cf6d7f0f276a49a6a2275a750e5850e8f9b20a4
SHA256 6b906c6174b54d0315ff4bf7cbcd1a9f02d493c942252db5c5d49ec9f5f12f8d
SHA512 12c4853dd6314212497fd44d32953c49985c4b2d5dab004595c45e0d87b12da5ffbbf6610cfe09a3750197e696beb0650843faa83004d063b0aef55e8951c531

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms

MD5 45d8799942c86cbb5a57bee8cb0ac07b
SHA1 aa02c48627782715d6a0d545995e65cf77eebeff
SHA256 a3200e64195e3f3eaf17239602f38684802bf8aa8786189ca0190ca9f7486b31
SHA512 ccc470401616d42115ab192956cefb5b9c360a1024eb33c3a9f521b7d951e6cd036e78e022652dee2ff35eba74cf16f2b4045b42849d8df4b13632c959b9499e

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Ringtone 08.wma

MD5 01c6a0605a97e6ad1541e469cefb08b7
SHA1 63a7535e651e5b753937f81c3ba39f85747eda68
SHA256 c8552f0d52a133e808ab064528dbf9ef1fc8cb2362b9a46b034938606d1a6c1e
SHA512 624d83e909d791ef0ffb228a6a30d75c60aeb1c88f519910b83d86bcfc4799c66349fb76fd417db4746de2e77c3882a0e5e4c0431909184b324e4de8d6c368fb

memory/1916-98-0x00000000039B0000-0x00000000040D5000-memory.dmp

\Program Files (x86)\Windows Media Player\en-US\SYMBOL.dll

MD5 e34351821762100fd33463fffbe7a0ae
SHA1 d12dda8fd686c35202f00bd83a745a06289e7536
SHA256 0b00ba5c15e8845bdef32b580607fac20908e07f194a99b66f7f2eb1a987c1ad
SHA512 d89f34e78b1320c4e4829c0e88f0dd8d6188e8a305527b224a818710edba08d51dcf187757b236239140e22d5092b0d62fec338dd8202b10a3e8b35d60dd784a

\Program Files (x86)\Windows Media Player\en-US\SYMBOL.dll

MD5 e34351821762100fd33463fffbe7a0ae
SHA1 d12dda8fd686c35202f00bd83a745a06289e7536
SHA256 0b00ba5c15e8845bdef32b580607fac20908e07f194a99b66f7f2eb1a987c1ad
SHA512 d89f34e78b1320c4e4829c0e88f0dd8d6188e8a305527b224a818710edba08d51dcf187757b236239140e22d5092b0d62fec338dd8202b10a3e8b35d60dd784a

\Program Files (x86)\Windows Media Player\en-US\SYMBOL.dll

MD5 e34351821762100fd33463fffbe7a0ae
SHA1 d12dda8fd686c35202f00bd83a745a06289e7536
SHA256 0b00ba5c15e8845bdef32b580607fac20908e07f194a99b66f7f2eb1a987c1ad
SHA512 d89f34e78b1320c4e4829c0e88f0dd8d6188e8a305527b224a818710edba08d51dcf187757b236239140e22d5092b0d62fec338dd8202b10a3e8b35d60dd784a

\Program Files (x86)\Windows Media Player\en-US\SYMBOL.dll

MD5 e34351821762100fd33463fffbe7a0ae
SHA1 d12dda8fd686c35202f00bd83a745a06289e7536
SHA256 0b00ba5c15e8845bdef32b580607fac20908e07f194a99b66f7f2eb1a987c1ad
SHA512 d89f34e78b1320c4e4829c0e88f0dd8d6188e8a305527b224a818710edba08d51dcf187757b236239140e22d5092b0d62fec338dd8202b10a3e8b35d60dd784a

memory/1592-99-0x0000000000000000-mapping.dmp

memory/1592-105-0x0000000003910000-0x0000000004035000-memory.dmp

memory/1592-107-0x0000000003910000-0x0000000004035000-memory.dmp

memory/1592-108-0x0000000003910000-0x0000000004035000-memory.dmp

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

memory/1804-113-0x0000000000000000-mapping.dmp

memory/1916-114-0x00000000039B0000-0x00000000040D5000-memory.dmp

memory/1592-115-0x0000000003910000-0x0000000004035000-memory.dmp

memory/1908-116-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-12-19 10:04

Reported

2022-12-19 10:06

Platform

win10v2004-20220812-en

Max time kernel

125s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DefaultID\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\DefaultID.dll㘀" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DefaultID\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\DefaultID.dll㐀" C:\Windows\SysWOW64\rundll32.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DefaultID\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\SysWOW64\rundll32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3184 set thread context of 4368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WindowsPowerShell\Modules\ccloud.png C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\MCIMPP.mpp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\AddressBook2x.png C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\DefaultID.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook2x.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\3difr.x3d C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\main-cef.css C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\svchost.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe

"C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 904 -ip 904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 556

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23986

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\defaultid.dll",i1Y1bmlucQ==

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

C:\Windows\SysWOW64\schtasks.exe

schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 93.184.220.29:80 tcp
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 52.168.117.170:443 tcp
N/A 127.0.0.1:23986 tcp
N/A 127.0.0.1:1312 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 23.236.181.126:443 tcp
N/A 127.0.0.1:23986 tcp
N/A 199.163.173.38:443 tcp
N/A 224.0.0.251:5353 udp
N/A 127.0.0.1:1312 tcp
N/A 127.0.0.1:23983 tcp
N/A 127.0.0.1:23983 tcp

Files

memory/904-132-0x000000000227B000-0x0000000002351000-memory.dmp

memory/904-133-0x00000000023B0000-0x00000000024C5000-memory.dmp

memory/904-134-0x0000000000400000-0x0000000000517000-memory.dmp

memory/3184-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

memory/904-138-0x0000000000400000-0x0000000000517000-memory.dmp

memory/3184-139-0x0000000004630000-0x0000000004D55000-memory.dmp

memory/3184-140-0x0000000004630000-0x0000000004D55000-memory.dmp

memory/3184-141-0x00000000054A0000-0x00000000055E0000-memory.dmp

memory/3184-142-0x00000000054A0000-0x00000000055E0000-memory.dmp

memory/3184-143-0x00000000054A0000-0x00000000055E0000-memory.dmp

memory/3184-144-0x0000000005519000-0x000000000551B000-memory.dmp

memory/3184-145-0x00000000054A0000-0x00000000055E0000-memory.dmp

memory/3184-146-0x00000000054A0000-0x00000000055E0000-memory.dmp

memory/3184-147-0x00000000054A0000-0x00000000055E0000-memory.dmp

memory/4368-149-0x0000020019E60000-0x0000020019FA0000-memory.dmp

memory/4368-148-0x00007FF711936890-mapping.dmp

memory/4368-150-0x0000020019E60000-0x0000020019FA0000-memory.dmp

memory/4368-152-0x0000000000150000-0x0000000000369000-memory.dmp

memory/3184-151-0x0000000005519000-0x000000000551B000-memory.dmp

memory/4368-153-0x0000020018490000-0x00000200186BA000-memory.dmp

memory/3184-154-0x0000000004630000-0x0000000004D55000-memory.dmp

\??\c:\program files (x86)\windowspowershell\modules\defaultid.dll

MD5 a53099ba5b7e20ac3328fd8c3ca5740b
SHA1 18772dd1c153b4deb0b507fd847196671ad559ec
SHA256 6c1be76ddb00d5f4e8cf63b6383f9dbd462de13c83ff71038bc2962f0efb2187
SHA512 b7ee8f7f37aed8ccb8ee0558603d9c785311cdd4da10ea3c83468b573e1eae1d268f9640bcf2bf373081f854d21272044294c3fc278ef4bd5401a0e7a2974a02

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 517d550cbf26880577c87c1950812112
SHA1 eacff1ea97346804ca51499087f4bdab46c1347f
SHA256 b0fdac711f25c1cbb3ddeebbecc0a0223c8c64330602cb0a3d18f50dad6d1102
SHA512 d304425ab6689cdbbd96f74c3fb79d968ca0d7476ca9e4d5d60f821fc08d1a29bf11a8e5ffa818e08115afa42f1f6e80a0bee7be887331b08a85d7de0172fe78

C:\Program Files (x86)\WindowsPowerShell\Modules\DefaultID.dll

MD5 a53099ba5b7e20ac3328fd8c3ca5740b
SHA1 18772dd1c153b4deb0b507fd847196671ad559ec
SHA256 6c1be76ddb00d5f4e8cf63b6383f9dbd462de13c83ff71038bc2962f0efb2187
SHA512 b7ee8f7f37aed8ccb8ee0558603d9c785311cdd4da10ea3c83468b573e1eae1d268f9640bcf2bf373081f854d21272044294c3fc278ef4bd5401a0e7a2974a02

memory/4416-158-0x00000000036D0000-0x0000000003DF5000-memory.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\resource.xml

MD5 52cf638286d2e53bf8536fb9f4d8014d
SHA1 da04999d41cd61d6f6bf0dd87d515dcc85d33e29
SHA256 c6aea09422e8d810106006e4abe46a68bc918fc2b02ad135c90f68cd648e3b4a
SHA512 2398c927e9818ff3bf663463fb12120b4de3fdd9da2da241edefce2f2e5633f94274d66f1299acc13288bf9a7aca5ca40d91528807968227142e7842867012ed

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\stream.x64.en-us.db

MD5 a3c50402ad84ef273e1cbeb541d73389
SHA1 f5821ac76fff71ce7d447da98b5689278032511b
SHA256 d1cc394435822035a1467be9ad69281de6ecb1b1c83750cb7ccd6202d4c96971
SHA512 9518c804b317917243eb3d017a4ba9aed4cd4cbf86477646c33a83777f7cd6d30bacd576cc51069432a5e14f5888e64d9803d9709c10ba25c34bb4234305a53b

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftLync2013Win64.xml

MD5 e3a68bbd204d36868c6f5570e4576675
SHA1 bc5c44144e8e962c62f7febabdb3d0ba20a8162a
SHA256 11031974100f363daebe2d5c9e4bf67418d662c73e0341eb71e10b91a33280ac
SHA512 7c435d9f0e05469979ac3ce3153ad96ac1b01c9946b3df7230b384cc3ed1a2766dfbad0eb00fa1f2105d0fc0e5a87cbc1eb2c6c700c1041ebe4488a6d16c2f02

memory/2660-162-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\WindowsPowerShell\Modules\DefaultID.dll

MD5 a53099ba5b7e20ac3328fd8c3ca5740b
SHA1 18772dd1c153b4deb0b507fd847196671ad559ec
SHA256 6c1be76ddb00d5f4e8cf63b6383f9dbd462de13c83ff71038bc2962f0efb2187
SHA512 b7ee8f7f37aed8ccb8ee0558603d9c785311cdd4da10ea3c83468b573e1eae1d268f9640bcf2bf373081f854d21272044294c3fc278ef4bd5401a0e7a2974a02

memory/4416-164-0x00000000036D0000-0x0000000003DF5000-memory.dmp

memory/2660-165-0x0000000004980000-0x00000000050A5000-memory.dmp

memory/2660-166-0x0000000004980000-0x00000000050A5000-memory.dmp

memory/2660-167-0x0000000004980000-0x00000000050A5000-memory.dmp

memory/5076-168-0x0000000000000000-mapping.dmp

memory/1948-169-0x0000000000000000-mapping.dmp

memory/4416-170-0x00000000036D0000-0x0000000003DF5000-memory.dmp