lumma | b1bc2eb5769d4aac65858a7873e477c87502efa4aafc2c62639dbe27dd951ef5

Analysis

max time kernel
105s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2023, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 206KB
Sample230115-fa359aea6x
SHA256 b1bc2eb5769d4aac65858a7873e477c87502efa4aafc2c62639dbe27dd951ef5
MD5 8213372d2686414c996068c6f821042c
SHA1 7f9767dd0d71412abcfc5d6c07ceddce5bfe0672
SHA512 b10fe5f3b5dfec8097b3f591d9503ebcc9591b462314ecb26eac8dd6fdbfd46edc0ecf593c94906724cedcb3e203f6176eee38e9f18778a39674edcb941651eb
SSDEEP 3072:BXtOI2FM5DWWTpi5YyAwbrHOMNpg+RS3xToapb:luFM5DWYeAMuFrp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/4996-133-0x0000000002E30000-0x0000000002E39000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 6 IoCs

flow	pid	Process
31	5056	rundll32.exe
44	5056	rundll32.exe
48	5056	rundll32.exe
54	5056	rundll32.exe
55	5056	rundll32.exe
56	5056	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2012	EB9D.exe
3640	C02.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MyriadCAD\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\MyriadCAD.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MyriadCAD\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService"	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
5056	rundll32.exe
232	svchost.exe
1300	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 5100	5056	rundll32.exe	89
PID 5056 set thread context of 1608	5056	rundll32.exe	93
PID 5056 set thread context of 2756	5056	rundll32.exe	98
PID 5056 set thread context of 1884	5056	rundll32.exe	105

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\cloud_icon.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\distribute_form.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\reflow.api	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\main.css	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\editpdf.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\stop_collection_data.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ccloud.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\delete.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\sqlite.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Scan_R_RHP.aapp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\MyriadCAD.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\delete.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AdobeLinguistic.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\drvDX9.x3d	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeLinguistic.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\editpdf.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\FullTrustNotifier.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1112	2012	WerFault.exe	81
2176	3640	WerFault.exe	107

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svchost.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	svchost.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002f56362d100054656d7000003a0009000400efbe0c5519992f563b2d2e00000000000000000000000000000000000000000000000000e20d3a00540065006d007000000014000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2424	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4996	file.exe
4996	file.exe
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4996	file.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeDebugPrivilege	5056	rundll32.exe
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
5100	rundll32.exe
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
5056	rundll32.exe
1608	rundll32.exe
5056	rundll32.exe
2756	rundll32.exe
5056	rundll32.exe
1884	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2424	Process not Found
2424	Process not Found

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2012	2424	Process not Found	81
PID 2424 wrote to memory of 2012	2424	Process not Found	81
PID 2424 wrote to memory of 2012	2424	Process not Found	81
PID 2012 wrote to memory of 5056	2012	EB9D.exe	83
PID 2012 wrote to memory of 5056	2012	EB9D.exe	83
PID 2012 wrote to memory of 5056	2012	EB9D.exe	83
PID 232 wrote to memory of 1300	232	svchost.exe	88
PID 232 wrote to memory of 1300	232	svchost.exe	88
PID 232 wrote to memory of 1300	232	svchost.exe	88
PID 5056 wrote to memory of 5100	5056	rundll32.exe	89
PID 5056 wrote to memory of 5100	5056	rundll32.exe	89
PID 5056 wrote to memory of 5100	5056	rundll32.exe	89
PID 5056 wrote to memory of 4420	5056	rundll32.exe	90
PID 5056 wrote to memory of 4420	5056	rundll32.exe	90
PID 5056 wrote to memory of 4420	5056	rundll32.exe	90
PID 5056 wrote to memory of 1608	5056	rundll32.exe	93
PID 5056 wrote to memory of 1608	5056	rundll32.exe	93
PID 5056 wrote to memory of 1608	5056	rundll32.exe	93
PID 5056 wrote to memory of 3856	5056	rundll32.exe	94
PID 5056 wrote to memory of 3856	5056	rundll32.exe	94
PID 5056 wrote to memory of 3856	5056	rundll32.exe	94
PID 5056 wrote to memory of 4696	5056	rundll32.exe	96
PID 5056 wrote to memory of 4696	5056	rundll32.exe	96
PID 5056 wrote to memory of 4696	5056	rundll32.exe	96
PID 5056 wrote to memory of 2756	5056	rundll32.exe	98
PID 5056 wrote to memory of 2756	5056	rundll32.exe	98
PID 5056 wrote to memory of 2756	5056	rundll32.exe	98
PID 5056 wrote to memory of 4076	5056	rundll32.exe	99
PID 5056 wrote to memory of 4076	5056	rundll32.exe	99
PID 5056 wrote to memory of 4076	5056	rundll32.exe	99
PID 5056 wrote to memory of 2876	5056	rundll32.exe	101
PID 5056 wrote to memory of 2876	5056	rundll32.exe	101
PID 5056 wrote to memory of 2876	5056	rundll32.exe	101
PID 5056 wrote to memory of 1884	5056	rundll32.exe	105
PID 5056 wrote to memory of 1884	5056	rundll32.exe	105
PID 5056 wrote to memory of 1884	5056	rundll32.exe	105
PID 2424 wrote to memory of 3640	2424	Process not Found	107
PID 2424 wrote to memory of 3640	2424	Process not Found	107
PID 2424 wrote to memory of 3640	2424	Process not Found	107
PID 5056 wrote to memory of 2504	5056	rundll32.exe	108
PID 5056 wrote to memory of 2504	5056	rundll32.exe	108
PID 5056 wrote to memory of 2504	5056	rundll32.exe	108

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4996

C:\Users\Admin\AppData\Local\Temp\EB9D.exe
C:\Users\Admin\AppData\Local\Temp\EB9D.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
  2⤵
  - Blocklisted process makes network request
  - Sets DLL path for service in the registry
  - Sets service image path in registry
  - Loads dropped DLL
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5056
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4420
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4696
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2876
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2504
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4356
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3672
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:5044
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4652
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4376
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3672
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4212
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18671
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 556
  2⤵
  - Program crash
  PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2012 -ip 2012
1⤵
PID:4980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\myriadcad.dll",Xiwyakp0MkNB
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:1300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1548

C:\Users\Admin\AppData\Local\Temp\C02.exe
C:\Users\Admin\AppData\Local\Temp\C02.exe
1⤵
- Executes dropped EXE
PID:3640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1260
  2⤵
  - Program crash
  PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3640 -ip 3640
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MyriadCAD.dll

Path C:\Program Files (x86)\WindowsPowerShell\Modules\MyriadCAD.dll
Size 774KB
SHA256 2607fe0d602d838d852e3b2b8b0104eb910ab6d517050f778fd340743c31438f
MD5 61c181a83e030b68b917413cc1848203
SHA1 1ce2997250fa77b745c8a37f50f1a385d4be22e2
SHA512 d5b427327403c1b1465b8622bdefc0ed8b8092d8af1a908d9e05f5e746f7b9e1f6ab050662b02b3470d9af0528b70d3946b2096492a1c97644bc788f9e8cb803
SSDEEP 12288:ld7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:lpUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyriadCAD.dll

Path C:\Program Files (x86)\WindowsPowerShell\Modules\MyriadCAD.dll
Size 774KB
SHA256 2607fe0d602d838d852e3b2b8b0104eb910ab6d517050f778fd340743c31438f
MD5 61c181a83e030b68b917413cc1848203
SHA1 1ce2997250fa77b745c8a37f50f1a385d4be22e2
SHA512 d5b427327403c1b1465b8622bdefc0ed8b8092d8af1a908d9e05f5e746f7b9e1f6ab050662b02b3470d9af0528b70d3946b2096492a1c97644bc788f9e8cb803
SSDEEP 12288:ld7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:lpUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

C2RManifest.Proof.Culture.msi.16.fr-fr.xml

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
Size 23KB
SHA256 516aa640a48752bcadbd46e4f53c0560a1cb379d5366b1c9bb4d0706d1bd040f
MD5 37cde9afb1540513bd564d71867021e0
SHA1 e319abb6093025dccc55618fb407c1182ccdafe7
SHA512 6746350447a6a0424c90571c7cc3442d34af0cb16fa1459bb76b25423f165f474073f1d359462cb805ac376a9d069236d6b7a796332c27253a4807f691292881
SSDEEP 192:l/+vpvfAcr+MeVeC/yqjU4vWGNMf0rS03EwSA/fo:l/+hvI+evhjU4vu03bt/fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

EventStore.db

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\EventStore.db
Size 20KB
SHA256 574b8358c4063fb82c207de10b922c87d26e57207f355dc5bf4e8b209f1545e1
MD5 a5d0c68b795da553cf038fa776a4ee86
SHA1 03f4225c4e74d88e0936f31e2c162fda28751899
SHA512 ae21861d90f47d3ffbc7c8d669f23aabaa460fc8db74df0975c61ed1bb0b369eff94ca86a085b19bcb65eb708311883896c36a5bd692d9c2141e3b83b06384e3
SSDEEP 96:kuwMk9q3S7G35JG3gTfMhB8vlPkettMcbkT6qIMMiusdRA:kuuqi7G37TlvlPpttMQ1IW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe.xml

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe.xml
Size 820B
SHA256 a8ed53b828f69fb5e6e28eef9a38b5753320aa7a942b4a4c2dbf67705d21e309
MD5 a8664f5906d9060a0a87bc01e35179bb
SHA1 1bbbc9f10431d2941805907a8a6d4009f4e2938c
SHA512 389a4be3833050f89ea0bc5327514b3d80753eb6a214d4ad58d8c1b22770dcca2cdf099d4563db98e3d3f9530474b147e49cbed4b5b3e3a9e315a797f056049f
MD5 SHA1 SHA512

Submit Download

Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe.xml

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe.xml
Size 1KB
SHA256 28bf7f3525db4ecacb36705ff7d30bee209ff200a15178bae8a2f0f27f7058b8
MD5 c1e304a57b77d96dbac8ca07849f9b86
SHA1 76a2051cdd63b97419d076ee3e0972c7b11ee10c
SHA512 86b48ef3207a257799b9d9c0e23859391dd3c5984e30d4fa761bc8853bbcc8b37193ab4bdb95b7dd36906ebdd8ad83f29811d9c76675f93f261d9d0cf7a26662
MD5 SHA1 SHA512

Submit Download

Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe.xml

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe.xml
Size 1KB
SHA256 d97e577008c9cf9baa9939be4babe4690e5f1e6ad1e97234b2f40ee22927d7fe
MD5 4e453fc9a4e419d0eefa057cd136484f
SHA1 dd9eb7313819ab30488efbb4b3c6e34214d37078
SHA512 72182582106d4488619ce6531c61003a7dad2eeca1c7b381f90db967d41ba8685d0eb719cae42256c774a20d3db2adca4fdd3b2bd621439feac2ef72554e1ae2
MD5 SHA1 SHA512

Submit Download

MicrosoftOffice2016BackupWin32.xml

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\MicrosoftOffice2016BackupWin32.xml
Size 12KB
SHA256 caf2eef3b42d36b4d6d4a24597557a7feada559e99abedb56287248286531dea
MD5 ffbc41d3c63bccdca27c2c88ab0e85c4
SHA1 f3923962734058dc0b91515b2981d1eb33f8a8dd
SHA512 9da5dd978c9faa7de1552117207fb694e97f895b054a457ffe0b9444251e7203774b142ee558317136dd8f240c12f7309b137eb930417c181c404f8318a3f8fa
SSDEEP 96:d2oMAU5XwnoRBlolElolkWFFilolElolkxqm2RlolElolkVw4ylolElolkiGC6qh:khR2LFg2/PLBf5a38oplNl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TELEMETRY.ASM-WINDOWSSQ.json

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\TELEMETRY.ASM-WINDOWSSQ.json
Size 53B
SHA256 9d45f7e6114d2088ab05423697cafedc0a9926f785358cb2faddc4f1e45b193d
MD5 6b5c875287b25d64563bd7c830621b66
SHA1 df0c4dcbbf3ce6706cae126955b4fcb88be0694a
SHA512 608b92078a9082b4bfe2b066891127713cfd4329d8b26a3747b672c19e41e25242f60153517227a04a3f2b355805584cd4fe2f2dece45b1cd5dfc814a486d229
MD5 SHA1 SHA512

Submit Download

Uqioyhuair.tmp

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Uqioyhuair.tmp
Size 3.5MB
SHA256 e8949484fb9328282bec1ff7d4eb79a5c1ef96abdde065966379b91ade864857
MD5 df22adc6396ca883d6d0229011c8a0f0
SHA1 9138bd460feef0c1ee4eb5947d79c73a31a17e52
SHA512 fea3522d66413488a87f85782645c9728f739b647071a1d4474f85a7f1ac24fd404e2c942160313f69a651cc759634d296112b54ce7fd94d17bb6fa82c94e024
SSDEEP 49152:eVkEQ7GQsLZWoFCQ8ZcHVkgkzWufZ5hds+2/PoJRrNwz05Mj1jqqfGw62OVG:J/sLEoh8qH+WuB5DE/PgRrNktffV6vo
MD5 SHA1 SHA512 SSDEEP

Submit Download

folder.ico

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\folder.ico
Size 52KB
SHA256 bef53904908769ceeb60f8e0976c3194e73534f00f4afb65497c2091121b98b2
MD5 bbf9dbdc079c0cd95f78d728aa3912d4
SHA1 051f76cc8c6520768bac9559bb329abeebd70d7c
SHA512 af110c52c983f1cf55b3db7d375e03c8c9308e3cf9ee1c154c2b25cb3f8299f0c0ba87b47445f09f98659eb536184c245887a341733c11af713e9ecc15288b5d
SSDEEP 1536:y3i6EBXR2n7dqnfiVDIHMPV0+l/SLOUp4:8eiVD+EmUSLOUp4
MD5 SHA1 SHA512 SSDEEP

Submit Download

netfol.ico

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\netfol.ico
Size 28KB
SHA256 dca1bd2f368d6165695ac6f48239722b9d38226bef45764a0076bbfa184cb0a7
MD5 3fa8c6dc1f72c3f9f8670a3e236459f2
SHA1 fcca30e9c5f861ac907150c76ca5f2174d214b7b
SHA512 af6654f32cf0638204293e0117ff43e59f68537e391d3f4b1c7758632767eaa474d7cb44f3b4b7f9ba6cdefda9ec9368cf07814aed4e79949001bd44ede262ec
SSDEEP 384:1R11HomcgdR5DunYsIoK+3nUJOfwkK0KCd5A3PWMkAdn+VqQ0l/9gA+nylWD:X11HvJdaOz4UJOf9K0K13OTwCzylO
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource.xml

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\resource.xml
Size 1KB
SHA256 50ce5d2f9497955246143e7bb7d7584f221c15574a910c7cc11af87537711d25
MD5 9e3d2d6830eba41e31e8558da30ddccd
SHA1 f5fbe0dfef87a30a9898cd6e1e7691c7dd9a9b99
SHA512 d1f3774e8c2bdfb6acbb8b9429f59fce5048b5adc4ddc7ecacf7bf52862715db35aee04884a24a8e329e8d10aa5fd06cac5360aad9dd296582453fadadf4d7ee
MD5 SHA1 SHA512

Submit Download

s640.hash

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\s640.hash
Size 106B
SHA256 7f9c7cc5b265e312fc587d98c7c31218b7a46f1efb8c397dcc329354b4e5831d
MD5 bef40d5a19278ca19b56fbcdde7e26ef
SHA1 4f01d5b8de038e120c64bd7cc22cf150af1452fb
SHA512 5a361b1378c7b9f635e72ffdfba4d59acd17341caba480a5271237a37d40d8eb03a6ca7f3c38e73ce87a15b682d434ffa0a7f96dd6355e286d8213a80518c493
MD5 SHA1 SHA512

Submit Download

C02.exe

Path C:\Users\Admin\AppData\Local\Temp\C02.exe
Size 245KB
SHA256 758601b7d2c4c1c3ba050f4c9b0fd65f31f8d411965e2529ee22af93623f4148
MD5 f39ffa9812c55774a4dd1451b23fa2d4
SHA1 f9f60ac20bfe819d2a012d0fb19e88ea4e4a348d
SHA512 d35209af1f3ed8f0249bc14f70b9c6e95e88abc5c7d10d9e906761a09b98731c1279f87bae9699158e65e07e55e7f6a9d71be0dc9c4a6f07c529d2a668266b13
SSDEEP 3072:6X6yzapOKC/IC3FZvb5RWJyYC0cM2qHzH+8nYZECMuxljcrapb:aioKC/IKvjWjCiT68nYZCMAup
MD5 SHA1 SHA512 SSDEEP

Submit Download

C02.exe

Path C:\Users\Admin\AppData\Local\Temp\C02.exe
Size 245KB
SHA256 758601b7d2c4c1c3ba050f4c9b0fd65f31f8d411965e2529ee22af93623f4148
MD5 f39ffa9812c55774a4dd1451b23fa2d4
SHA1 f9f60ac20bfe819d2a012d0fb19e88ea4e4a348d
SHA512 d35209af1f3ed8f0249bc14f70b9c6e95e88abc5c7d10d9e906761a09b98731c1279f87bae9699158e65e07e55e7f6a9d71be0dc9c4a6f07c529d2a668266b13
SSDEEP 3072:6X6yzapOKC/IC3FZvb5RWJyYC0cM2qHzH+8nYZECMuxljcrapb:aioKC/IKvjWjCiT68nYZCMAup
MD5 SHA1 SHA512 SSDEEP

Submit Download

EB9D.exe

Path C:\Users\Admin\AppData\Local\Temp\EB9D.exe
Size 1.0MB
SHA256 d31d4c78c9d18ec58bff005ffb8dc8314369116628168fe886c9568ec1e2086e
MD5 cdaa1a093ef0360df6c70af0baeeefbd
SHA1 b4417c52eaeccd47805d2d36c4ac6ed91d5fd582
SHA512 0c9e82bdec30dc0a0e043e8109d715ee095335ade3a0a83011a430c50be0363780f3bc6feefbf71532655b1d550e4ecd7e7d5d68d5d3e77f232baaec6dabc5bd
SSDEEP 24576:VZIKR1qmPA4Bi+db3oTxppVV1Q7eKZ9aOLIUIx3vER0Dn03j8O5:VZIKRTiKsHl1ypCUIxcR0Dnuj8O5
MD5 SHA1 SHA512 SSDEEP

Submit Download

EB9D.exe

Path C:\Users\Admin\AppData\Local\Temp\EB9D.exe
Size 1.0MB
SHA256 d31d4c78c9d18ec58bff005ffb8dc8314369116628168fe886c9568ec1e2086e
MD5 cdaa1a093ef0360df6c70af0baeeefbd
SHA1 b4417c52eaeccd47805d2d36c4ac6ed91d5fd582
SHA512 0c9e82bdec30dc0a0e043e8109d715ee095335ade3a0a83011a430c50be0363780f3bc6feefbf71532655b1d550e4ecd7e7d5d68d5d3e77f232baaec6dabc5bd
SSDEEP 24576:VZIKR1qmPA4Bi+db3oTxppVV1Q7eKZ9aOLIUIx3vER0Dn03j8O5:VZIKRTiKsHl1ypCUIxcR0Dnuj8O5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sdaaysrpyefiy.tmp

Path C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Size 774KB
SHA256 b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d
MD5 e06fb66bfbe1444cc091f0297b8d32db
SHA1 c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af
SHA512 c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95
SSDEEP 12288:Nd7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:NpUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sdaaysrpyefiy.tmp

Path C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Size 774KB
SHA256 b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d
MD5 e06fb66bfbe1444cc091f0297b8d32db
SHA1 c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af
SHA512 c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95
SSDEEP 12288:Nd7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:NpUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

myriadcad.dll

Path \??\c:\program files (x86)\windowspowershell\modules\myriadcad.dll
Size 774KB
SHA256 2607fe0d602d838d852e3b2b8b0104eb910ab6d517050f778fd340743c31438f
MD5 61c181a83e030b68b917413cc1848203
SHA1 1ce2997250fa77b745c8a37f50f1a385d4be22e2
SHA512 d5b427327403c1b1465b8622bdefc0ed8b8092d8af1a908d9e05f5e746f7b9e1f6ab050662b02b3470d9af0528b70d3946b2096492a1c97644bc788f9e8cb803
SSDEEP 12288:ld7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:lpUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-194-0x00000000040E0000-0x0000000004C35000-memory.dmp

Download

memory/232-154-0x00000000040E0000-0x0000000004C35000-memory.dmp

Download

memory/232-168-0x00000000040E0000-0x0000000004C35000-memory.dmp

Download

memory/408-283-0x0000028B71840000-0x0000028B71980000-memory.dmp

Download

memory/408-286-0x0000028B6FF70000-0x0000028B70225000-memory.dmp

Download

memory/408-288-0x0000028B6FF70000-0x0000028B70225000-memory.dmp

Download

memory/1252-274-0x0000019216560000-0x00000192166A0000-memory.dmp

Download

memory/1252-277-0x0000019214AF0000-0x0000019214DA5000-memory.dmp

Download

memory/1252-273-0x0000019216560000-0x00000192166A0000-memory.dmp

Download

memory/1252-275-0x0000019214AF0000-0x0000019214DA5000-memory.dmp

Download

memory/1300-181-0x00000000047A0000-0x00000000052F5000-memory.dmp

Download

memory/1300-178-0x00000000047A0000-0x00000000052F5000-memory.dmp

Download

memory/1544-252-0x000001865AC70000-0x000001865ADB0000-memory.dmp

Download

memory/1544-255-0x0000018659210000-0x00000186594C5000-memory.dmp

Download

memory/1544-251-0x000001865AC70000-0x000001865ADB0000-memory.dmp

Download

memory/1544-253-0x0000018659210000-0x00000186594C5000-memory.dmp

Download

memory/1608-193-0x00000210E2A70000-0x00000210E2D25000-memory.dmp

Download

memory/1608-191-0x00000210E2A70000-0x00000210E2D25000-memory.dmp

Download

memory/1608-190-0x00000210E2920000-0x00000210E2A60000-memory.dmp

Download

memory/1608-189-0x00000210E2920000-0x00000210E2A60000-memory.dmp

Download

memory/1884-215-0x000001E515EF0000-0x000001E5161A5000-memory.dmp

Download

memory/1884-213-0x000001E517950000-0x000001E517A90000-memory.dmp

Download

memory/1884-220-0x000001E515EF0000-0x000001E5161A5000-memory.dmp

Download

memory/1884-214-0x000001E517950000-0x000001E517A90000-memory.dmp

Download

memory/1984-241-0x0000018358070000-0x00000183581B0000-memory.dmp

Download

memory/1984-242-0x0000018358070000-0x00000183581B0000-memory.dmp

Download

memory/1984-243-0x0000018356610000-0x00000183568C5000-memory.dmp

Download

memory/1984-244-0x0000018356610000-0x00000183568C5000-memory.dmp

Download

memory/2012-145-0x0000000000400000-0x0000000002C74000-memory.dmp

Download

memory/2012-144-0x0000000000400000-0x0000000002C74000-memory.dmp

Download

memory/2012-142-0x00000000048D9000-0x00000000049C2000-memory.dmp

Download

memory/2012-143-0x00000000049D0000-0x0000000004AFE000-memory.dmp

Download

memory/2060-298-0x000001E5C2B90000-0x000001E5C2E45000-memory.dmp

Download

memory/2060-309-0x000001E5C2B90000-0x000001E5C2E45000-memory.dmp

Download

memory/2756-206-0x000001EF865B0000-0x000001EF86865000-memory.dmp

Download

memory/2756-202-0x000001EF88010000-0x000001EF88150000-memory.dmp

Download

memory/2756-203-0x000001EF865B0000-0x000001EF86865000-memory.dmp

Download

memory/2756-204-0x000001EF88010000-0x000001EF88150000-memory.dmp

Download

memory/3640-234-0x0000000000400000-0x0000000002BA5000-memory.dmp

Download

memory/3640-231-0x0000000000400000-0x0000000002BA5000-memory.dmp

Download

memory/3640-227-0x0000000002E00000-0x0000000002E2A000-memory.dmp

Download

memory/3640-225-0x0000000002EC9000-0x0000000002EE3000-memory.dmp

Download

memory/3956-263-0x00000214A8580000-0x00000214A86C0000-memory.dmp

Download

memory/3956-266-0x00000214A6B20000-0x00000214A6DD5000-memory.dmp

Download

memory/3956-264-0x00000214A6B20000-0x00000214A6DD5000-memory.dmp

Download

memory/3956-262-0x00000214A8580000-0x00000214A86C0000-memory.dmp

Download

memory/4488-232-0x0000023165B40000-0x0000023165DF5000-memory.dmp

Download

memory/4488-235-0x0000023165B40000-0x0000023165DF5000-memory.dmp

Download

memory/4488-228-0x00000231675A0000-0x00000231676E0000-memory.dmp

Download

memory/4488-229-0x00000231675A0000-0x00000231676E0000-memory.dmp

Download

memory/4540-307-0x00000000012C0000-0x0000000001E15000-memory.dmp

Download

memory/4540-299-0x0000000000600000-0x0000000001036000-memory.dmp

Download

memory/4948-318-0x00000229B7240000-0x00000229B74F5000-memory.dmp

Download

memory/4996-132-0x0000000002EA9000-0x0000000002EBA000-memory.dmp

Download

memory/4996-134-0x0000000000400000-0x0000000002B9C000-memory.dmp

Download

memory/4996-135-0x0000000000400000-0x0000000002B9C000-memory.dmp

Download

memory/4996-133-0x0000000002E30000-0x0000000002E39000-memory.dmp

Download

memory/5056-257-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-197-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-248-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-249-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-246-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-239-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-238-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-237-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-236-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-223-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-224-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-222-0x00000000076D0000-0x0000000007810000-memory.dmp

Download

memory/5056-258-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-259-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-260-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-221-0x00000000076D0000-0x0000000007810000-memory.dmp

Download

memory/5056-211-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-210-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-209-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-208-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-200-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-199-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-268-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-269-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-271-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-270-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-198-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-247-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-196-0x0000000005D7C000-0x0000000005D7E000-memory.dmp

Download

memory/5056-187-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-186-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-185-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-278-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-279-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-280-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-281-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-184-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-176-0x0000000005D7C000-0x0000000005D7E000-memory.dmp

Download

memory/5056-297-0x0000000005E06000-0x0000000005E08000-memory.dmp

Download

memory/5056-172-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-171-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-170-0x00000000076D0000-0x0000000007810000-memory.dmp

Download

memory/5056-147-0x0000000005020000-0x0000000005B75000-memory.dmp

Download

memory/5056-169-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-150-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-149-0x0000000005D60000-0x0000000005EA0000-memory.dmp

Download

memory/5056-317-0x0000000005E06000-0x0000000005E08000-memory.dmp

Download

memory/5056-148-0x0000000005020000-0x0000000005B75000-memory.dmp

Download

memory/5100-180-0x000001E30ADA0000-0x000001E30B055000-memory.dmp

Download

memory/5100-182-0x000001E30ADA0000-0x000001E30B055000-memory.dmp

Download

memory/5100-179-0x0000000000A90000-0x0000000000D34000-memory.dmp

Download

memory/5100-175-0x000001E30C800000-0x000001E30C940000-memory.dmp

Download

memory/5100-177-0x000001E30C800000-0x000001E30C940000-memory.dmp

Download