99506687544a521f802e31c8774f28343c0187b63879d6f45b5e9ffc1e09476e

Analysis

max time kernel
600s
max time network
524s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MakuTweaker 5.8.7.exe
Size 77.9MB
Sample260928-nmfjqaae49
SHA256 99506687544a521f802e31c8774f28343c0187b63879d6f45b5e9ffc1e09476e
MD5 9e9ba57741f02aebdbbd877362d1d482
SHA1 9aa6fe2050101b5fd918e67e02e6566b3e0ac938
SHA512 aeab7687c8705c3a0a6bd05863a676995ef501b36384f3901529b72fad6f7a22d106158ba11304b69c669583327e469e04bc6698041fa3e8289bec0ed1bcf28c
SSDEEP 1572864:a5nHEoeeCw1rhWG+tf6fj4ulm3Uc6tf4qLUVNNBqFgWp1o0/Fe:uExQP+ZyjNLQuUVNmFHfo09e
TLSH
T1AB082356E2FD00E8D97AC0BCC6575527E7B23459133097EB61A48A692F37BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 4 IoCs

pid	Process
5280	MakuTweaker 5.8.7.exe
5280	MakuTweaker 5.8.7.exe
5280	MakuTweaker 5.8.7.exe
5280	MakuTweaker 5.8.7.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MakuTweaker 5.8.7.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
	\??\F:\	explorer.exe
	\??\E:\	explorer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MakuTweaker 5.8.7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MakuTweaker 5.8.7.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Colors	MakuTweaker 5.8.7.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{BA732805-088D-4D6B-9863-E8E7816D69DF}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{8BE69B5D-D860-4E7D-AA5F-B314153DE733}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6008	explorer.exe
6008	explorer.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5280	MakuTweaker 5.8.7.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe
Token: SeShutdownPrivilege	6008	explorer.exe
Token: SeCreatePagefilePrivilege	6008	explorer.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
5280	MakuTweaker 5.8.7.exe
4592	sihost.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
5280	MakuTweaker 5.8.7.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe
6008	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5420	StartMenuExperienceHost.exe
5132	SearchHost.exe
6008	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 6008	4592	sihost.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MakuTweaker 5.8.7.exe
"C:\Users\Admin\AppData\Local\Temp\MakuTweaker 5.8.7.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3508

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6008

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5132

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mdceorll.newcfg

Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Path_scxdfrq3qufuo2pmzp0f1oxxsuqljaqa\5.8.7.0\mdceorll.newcfg
Size 1KB
SHA256 ec6ebc324de186aba365f6d337e985312055fa5855f8f6a50feff65821f95c11
MD5 c3d187ee960d4cdf81909fe19dc82420
SHA1 124d00c9956a2213950582aba56dcf8c154eacd5
SHA512 8994620db159b38096e4067937a7ad599e89a4cd0312396e1b9e6b57081143e91498c6bc0881b6b8950d6dd0b2d8962c41568d8c5aa69c4f123c0f95f949f15a
TLSH
T10F210B0971C5BF6B01325A33D6254240DEB013A7456974F8F5BD72679F368CA0BD33A9
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Path_scxdfrq3qufuo2pmzp0f1oxxsuqljaqa\5.8.7.0\user.config
Size 1KB
SHA256 e86df0aeecbb6f729648c035c9425af7b1ff568ebab214ae6af964f458b8c6a4
MD5 8f3312401ae27805da5499ba3d348f3c
SHA1 8f8f453a9574eaa1ae055ecd8417b2cdfca8a2e8
SHA512 65bfcc5783b2285cf8d5e7836e1b7feb4e4343bbe0007361a68e41219ad37bd757499ef8831eb046c55462f932171370609ba7dfb6b0403fd45c0b294755e542
TLSH
T120210A0971C5BF6B01225A33D6254240DEB013A7456974B8F5BD726B9F364CA0BD33AA
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\MakuTweaker 5.8.7\U4C6lsQ8xKX0\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicaWPFRuntimeComponent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\MakuTweaker 5.8.7\U4C6lsQ8xKX0\MicaWPFRuntimeComponent.dll
Size 84KB
SHA256 f1493739f79dd110a8a8cf0a2d0458210a2a65f22815bc1fd5ff1fb35cfd62ad
MD5 676613ec0c4838c9edda43a022f01ac0
SHA1 f32152b21f27d58ca31b6a39cdb46cb889e5a914
SHA512 929d8c8c5e09316c99c43771fb57e1fb2030a50ad5dca9eb6bd5fcb9ab61874f130198dc837addbb9e08ed795f3a5a36c6708e177f4c9d31aa7060a15738d7aa
SSDEEP 1536:YThrAtH3nUGxOFJWR4KMUDRZu0yUe4sDOVw9ezpqPnUZ01I1YnlnHwiklAX4z4IM:YThYH3nUGqKfDfu0yUerqVwl
TLSH
T1798309D672A46784DD6A637448839AA0E772F0A15720C3CBA392432E0F337C5DEFB561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\MakuTweaker 5.8.7\U4C6lsQ8xKX0\PresentationNative_cor3.dll
Size 1.2MB
SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
MD5 b43c09fd1eab8feb0d9d87e6eeb8fa95
SHA1 d8935765faf6e12d1d7f7e8b0f54f8e0f077a43c
SHA512 1432fefe98029f475c0a53e0c551dd917713da346e9b7d5ee5ee5314fb43072cfb24f95b4e2ceef2f67d7f01084d398428b075bf09812a9f90f510f0a40bdfc8
SSDEEP 24576:mhNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa7:mxKcdPHmMLYpX7T35/fPoGPpGFjztQcT
TLSH
T1F0453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\MakuTweaker 5.8.7\U4C6lsQ8xKX0\wpfgfx_cor3.dll
Size 1.9MB
SHA256 cc40e27a3a7e14dd4a8c423081fa367406e093be1dc79759e56d828e140bc014
MD5 c0a4429e4c59b9b4487c570ca92cd312
SHA1 2263d4e13f507225964c53588a32af0734a7a13c
SHA512 d5ae03a6d38880eb1eb19dda5e8b3e110f2ac8df46f668b4736055e34f4680f6a679db3b236311829cc1caac951a147d6f1c2b473f6eda245a764bd4844d333e
SSDEEP 24576:15AzCIrGoleR+kYpETy2yS2Wfb6stIyHXo9HSTt4Myji4sfm/FP9dZDNQJg:CVvcR+kYyrybWbISyHSHyjiffmTlMg
TLSH
T1CA954A4AB6AC40E9C0BAD23CDADB461BF23174152761A7CF27A0479D6F27BD0097B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5132-282-0x0000028D89EC0000-0x0000028D89EE0000-memory.dmp

Download

memory/5132-283-0x0000028D9A300000-0x0000028D9A400000-memory.dmp

Download

memory/5132-320-0x0000028D9AB30000-0x0000028D9AB50000-memory.dmp

Download

memory/5132-274-0x0000028D86690000-0x0000028D86790000-memory.dmp

Download

memory/5132-295-0x0000028D8A120000-0x0000028D8A140000-memory.dmp

Download

memory/5132-438-0x0000028D9FEB0000-0x0000028D9FFD3000-memory.dmp

Download

memory/5280-115-0x0000029804DA0000-0x0000029804DF0000-memory.dmp

Download

memory/5280-151-0x00000298086D0000-0x0000029808720000-memory.dmp

Download

memory/5280-95-0x0000029803780000-0x0000029803840000-memory.dmp

Download

memory/5280-91-0x0000029803620000-0x0000029803660000-memory.dmp

Download

memory/5280-103-0x0000029803680000-0x00000298036B0000-memory.dmp

Download

memory/5280-99-0x0000029804C40000-0x0000029804CD0000-memory.dmp

Download

memory/5280-87-0x0000029803490000-0x00000298034C0000-memory.dmp

Download

memory/5280-64-0x0000029803280000-0x00000298032A0000-memory.dmp

Download

memory/5280-60-0x00000298032E0000-0x0000029803320000-memory.dmp

Download

memory/5280-56-0x0000029803260000-0x0000029803280000-memory.dmp

Download

memory/5280-48-0x00000298013F0000-0x0000029801410000-memory.dmp

Download

memory/5280-44-0x00000298013E0000-0x00000298013F0000-memory.dmp

Download

memory/5280-40-0x0000029800020000-0x0000029800040000-memory.dmp

Download

memory/5280-36-0x00000298000D0000-0x0000029800150000-memory.dmp

Download

memory/5280-20-0x000002984E660000-0x000002984E7C0000-memory.dmp

Download

memory/5280-16-0x00000298506F0000-0x0000029850920000-memory.dmp

Download

memory/5280-107-0x00000298038D0000-0x00000298038F0000-memory.dmp

Download

memory/5280-111-0x00000298034C0000-0x00000298034D0000-memory.dmp

Download

memory/5280-119-0x0000029804DF0000-0x0000029804E10000-memory.dmp

Download

memory/5280-79-0x0000029803530000-0x0000029803580000-memory.dmp

Download

memory/5280-123-0x0000029804E10000-0x0000029804E30000-memory.dmp

Download

memory/5280-127-0x00000298059C0000-0x0000029805BC0000-memory.dmp

Download

memory/5280-131-0x00000298078F0000-0x0000029807C70000-memory.dmp

Download

memory/5280-139-0x0000029804E50000-0x0000029804E60000-memory.dmp

Download

memory/5280-135-0x0000029805BC0000-0x0000029805C20000-memory.dmp

Download

memory/5280-143-0x0000029805D20000-0x0000029805D90000-memory.dmp

Download

memory/5280-147-0x0000029809EF0000-0x000002980ABE0000-memory.dmp

Download

memory/5280-83-0x00000298040A0000-0x0000029804840000-memory.dmp

Download

memory/5280-155-0x0000029804F80000-0x0000029804F90000-memory.dmp

Download

memory/5280-161-0x0000029808FB0000-0x0000029809110000-memory.dmp

Download

memory/5280-169-0x0000029809110000-0x0000029809180000-memory.dmp

Download

memory/5280-173-0x000002980AFF0000-0x000002980B0A0000-memory.dmp

Download

memory/5280-165-0x000002980AD90000-0x000002980AF40000-memory.dmp

Download

memory/5280-182-0x00000298091B0000-0x0000029809200000-memory.dmp

Download

memory/5280-188-0x000002980F350000-0x000002980F3A0000-memory.dmp

Download

memory/5280-192-0x0000029808730000-0x0000029808740000-memory.dmp

Download

memory/5280-196-0x000002980F8C0000-0x000002980FB80000-memory.dmp

Download

memory/5280-200-0x000002980F4E0000-0x000002980F5E0000-memory.dmp

Download

memory/5280-204-0x000002980FD60000-0x000002980FDF0000-memory.dmp

Download

memory/5280-208-0x000002980F5E0000-0x000002980F600000-memory.dmp

Download

memory/5280-212-0x000002980F4C0000-0x000002980F4D0000-memory.dmp

Download

memory/5280-216-0x000002980FCC0000-0x000002980FCD0000-memory.dmp

Download

memory/5280-68-0x0000029803390000-0x00000298033C0000-memory.dmp

Download

memory/5280-220-0x0000029812160000-0x00000298122E0000-memory.dmp

Download

memory/5280-241-0x000002980FCB0000-0x000002980FCC0000-memory.dmp

Download

memory/5280-245-0x0000029815A90000-0x0000029815BA0000-memory.dmp

Download

memory/5280-250-0x0000029815C70000-0x0000029815D40000-memory.dmp

Download

memory/5280-72-0x0000029803340000-0x0000029803360000-memory.dmp

Download

memory/5280-52-0x0000029801430000-0x0000029801450000-memory.dmp

Download

memory/5280-32-0x0000029800BB0000-0x00000298013E0000-memory.dmp

Download

memory/5280-28-0x000002984DFE0000-0x000002984E020000-memory.dmp

Download

memory/5280-24-0x000002984C6E0000-0x000002984C730000-memory.dmp

Download

memory/5280-12-0x0000029851AF0000-0x0000029852A50000-memory.dmp

Download

memory/5280-9-0x000002984F470000-0x0000029850100000-memory.dmp

Download