danabot | 090cb19f8745e669eeb19d014ba18abdf9b447f1a2519b15569558bfb079bf6a

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 272KB
Sample221005-n2vl7aedhp
SHA256 090cb19f8745e669eeb19d014ba18abdf9b447f1a2519b15569558bfb079bf6a
MD5 dc37acf1e69f7bf1ea417c9f408e0abf
SHA1 c6333d1ef0302a4a536899aefbe58264f575b481
SHA512 91d43e9f49f19935bfbf31218dfc60428981fb27db525e431bfca9b3dcac6f94bd6070aca60edce985efae948c5fc7aeae57a5f52f7b8c2fef337f38541ad8d6
SSDEEP 6144:10fqNSLXc1X5SHuImlcuzbgwuLW2DBIeTwVf:1kqNSjc1XQm2unni
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot smokeloader systembc backdoor banker trojan

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
EAD30BF58E340E9E105B328F524565E0
type
loader

Extracted

Family

systembc

45.182.189.231:443

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/3224-133-0x0000000000590000-0x0000000000599000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Blocklisted process makes network request 1 IoCs

flow	pid	Process
78	1680	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1304	DDB3.exe
2276	2924.exe
4020	vfceg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 1680	1304	DDB3.exe	103

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\vfceg.job	2924.exe
File opened for modification	C:\Windows\Tasks\vfceg.job	2924.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4280	1304	WerFault.exe	90
840	1304	WerFault.exe	90
4792	1304	WerFault.exe	90
3408	2276	WerFault.exe	95

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe

Checks processor information in registry 2 TTPs 47 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DDB3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	DDB3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	DDB3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	DDB3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	DDB3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2804	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	file.exe
3224	file.exe
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3224	file.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeShutdownPrivilege	388	svchost.exe
Token: SeShutdownPrivilege	388	svchost.exe
Token: SeCreatePagefilePrivilege	388	svchost.exe
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2804	Process not Found
2804	Process not Found

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1304	2804	Process not Found	90
PID 2804 wrote to memory of 1304	2804	Process not Found	90
PID 2804 wrote to memory of 1304	2804	Process not Found	90
PID 1304 wrote to memory of 212	1304	DDB3.exe	91
PID 1304 wrote to memory of 212	1304	DDB3.exe	91
PID 1304 wrote to memory of 212	1304	DDB3.exe	91
PID 2804 wrote to memory of 2276	2804	Process not Found	95
PID 2804 wrote to memory of 2276	2804	Process not Found	95
PID 2804 wrote to memory of 2276	2804	Process not Found	95
PID 1304 wrote to memory of 1680	1304	DDB3.exe	103
PID 1304 wrote to memory of 1680	1304	DDB3.exe	103
PID 1304 wrote to memory of 1680	1304	DDB3.exe	103
PID 1304 wrote to memory of 1680	1304	DDB3.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3224

C:\Users\Admin\AppData\Local\Temp\DDB3.exe
C:\Users\Admin\AppData\Local\Temp\DDB3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  C:\Windows\system32\agentactivationruntimestarter.exe
  2⤵
  PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 872
  2⤵
  - Program crash
  PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 904
  2⤵
  - Program crash
  PID:840
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 824
  2⤵
  - Program crash
  PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x414
1⤵
PID:3904

C:\Users\Admin\AppData\Local\Temp\2924.exe
C:\Users\Admin\AppData\Local\Temp\2924.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 492
  2⤵
  - Program crash
  PID:3408

C:\ProgramData\elds\vfceg.exe
C:\ProgramData\elds\vfceg.exe start
1⤵
- Executes dropped EXE
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1304 -ip 1304
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1304 -ip 1304
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1304 -ip 1304
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2276 -ip 2276
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vfceg.exe

Path C:\ProgramData\elds\vfceg.exe
Size 272KB
SHA256 26faccb0c74428581e5bbef324c1b97b8ea051fd2e338458e4f3666df820cc35
MD5 e65cf57f3ed45b81ab93f646693378b6
SHA1 b89a46ffc0381bad71bb5cb3f4612e6fa5952d62
SHA512 0bdf0617f38f5c21519b3af66e52ad0c588569c8470488bfd148660f4632a9e0512226d45c88140b9e4686ef75d8e6ed1572a0f1badb51ac3d6f5b9bd2d369b3
SSDEEP 6144:H4fqQKLc4TpsHp9Bn0S1uzbgwugBDg/jykmwVf:HwqQKI4T4TiYunn5c/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

vfceg.exe

Path C:\ProgramData\elds\vfceg.exe
Size 272KB
SHA256 26faccb0c74428581e5bbef324c1b97b8ea051fd2e338458e4f3666df820cc35
MD5 e65cf57f3ed45b81ab93f646693378b6
SHA1 b89a46ffc0381bad71bb5cb3f4612e6fa5952d62
SHA512 0bdf0617f38f5c21519b3af66e52ad0c588569c8470488bfd148660f4632a9e0512226d45c88140b9e4686ef75d8e6ed1572a0f1badb51ac3d6f5b9bd2d369b3
SSDEEP 6144:H4fqQKLc4TpsHp9Bn0S1uzbgwugBDg/jykmwVf:HwqQKI4T4TiYunn5c/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

2924.exe

Path C:\Users\Admin\AppData\Local\Temp\2924.exe
Size 272KB
SHA256 26faccb0c74428581e5bbef324c1b97b8ea051fd2e338458e4f3666df820cc35
MD5 e65cf57f3ed45b81ab93f646693378b6
SHA1 b89a46ffc0381bad71bb5cb3f4612e6fa5952d62
SHA512 0bdf0617f38f5c21519b3af66e52ad0c588569c8470488bfd148660f4632a9e0512226d45c88140b9e4686ef75d8e6ed1572a0f1badb51ac3d6f5b9bd2d369b3
SSDEEP 6144:H4fqQKLc4TpsHp9Bn0S1uzbgwugBDg/jykmwVf:HwqQKI4T4TiYunn5c/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

2924.exe

Path C:\Users\Admin\AppData\Local\Temp\2924.exe
Size 272KB
SHA256 26faccb0c74428581e5bbef324c1b97b8ea051fd2e338458e4f3666df820cc35
MD5 e65cf57f3ed45b81ab93f646693378b6
SHA1 b89a46ffc0381bad71bb5cb3f4612e6fa5952d62
SHA512 0bdf0617f38f5c21519b3af66e52ad0c588569c8470488bfd148660f4632a9e0512226d45c88140b9e4686ef75d8e6ed1572a0f1badb51ac3d6f5b9bd2d369b3
SSDEEP 6144:H4fqQKLc4TpsHp9Bn0S1uzbgwugBDg/jykmwVf:HwqQKI4T4TiYunn5c/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDB3.exe

Path C:\Users\Admin\AppData\Local\Temp\DDB3.exe
Size 4.6MB
SHA256 5c4a2224b4860384c14198e380b58d699f4097f13b1b06e763ce90c90c993901
MD5 770da319c7917f59d3d14d32846fa0e9
SHA1 5037b449edc9fab7ca54b0a6361c1cbdce1f7596
SHA512 ad6b2e85718b7aebcace0eec870a3007e91d2f95605b158f2953f97ac24bc17cf2f0a077ef5d694a584fe0750e84383ca14d3ca938a5e25888fd10edb393fe0d
SSDEEP 98304:kyuqYJMlv4AG/mKSWf36eUjzko3aUtDkAJczGu0aNpFHfdDv:QqKMlgAns6eUko3DtDkAJuG8NPfdD
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDB3.exe

Path C:\Users\Admin\AppData\Local\Temp\DDB3.exe
Size 4.6MB
SHA256 5c4a2224b4860384c14198e380b58d699f4097f13b1b06e763ce90c90c993901
MD5 770da319c7917f59d3d14d32846fa0e9
SHA1 5037b449edc9fab7ca54b0a6361c1cbdce1f7596
SHA512 ad6b2e85718b7aebcace0eec870a3007e91d2f95605b158f2953f97ac24bc17cf2f0a077ef5d694a584fe0750e84383ca14d3ca938a5e25888fd10edb393fe0d
SSDEEP 98304:kyuqYJMlv4AG/mKSWf36eUjzko3aUtDkAJczGu0aNpFHfdDv:QqKMlgAns6eUko3DtDkAJuG8NPfdD
MD5 SHA1 SHA512 SSDEEP

Submit Download

TMKNGOMU-20220812-1924.log

Path C:\Users\Admin\AppData\Local\Temp\TMKNGOMU-20220812-1924.log
Size 56KB
SHA256 1226acee43898580e53859127ed657800319973cb60df51155e5c8a7ce45e895
MD5 942061e415bb8ead9b5a5218d5c14343
SHA1 6017ef310882921100fa81965ff75e420200507d
SHA512 b0a93f95992a6389ba9913d8ca29aaba421f25aea2463244468f3279185f88dddd3db4ecc9d58e4c73ac9901465548df24150978f3bc8a943376a176f605cddd
SSDEEP 1536:mLUsQsETTcOWWWMT84wO8gwRjNj2BqdapyRt4iVbLswSq/cgb++G6B4Y6PzLH3rK:qxic2CgBqda83
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uapaipuuih.tmp

Path C:\Users\Admin\AppData\Local\Temp\Uapaipuuih.tmp
Size 3.3MB
SHA256 e473b9afa947ef211c7e7cad6521687d504ec244a22f5ea5381f7020f947fc7d
MD5 963024ce4b5518f20619bdcb2998a789
SHA1 bbce53b5aa2beeff5c9f1555a1e32350bba479b2
SHA512 468f341fb7c284f0024ad5d13a72264d60e77b9ea724a770b4d45856dc0aaedd30e51263ea266e6979d7db1079703a9bc1358c5562aac6761ee45c06436baae8
SSDEEP 49152:uBDRx3xq9F1QL+8wq74fDayjuTJBc3SYI6cwm/p2h2l9MSUOsrV9XGHb:Kdb+Fd8E7auWQbI6VFh2vMH27
MD5 SHA1 SHA512 SSDEEP

Submit Download

aria-debug-1700.log

Path C:\Users\Admin\AppData\Local\Temp\aria-debug-1700.log
Size 470B
SHA256 9c5a7d9152e24a699bb5d058d978b5eec9aa309d8a73f4dc74fa18cb5900ef13
MD5 afbde07b463b84a12621ff8a45aaae1b
SHA1 1f78c7b3bae0de87727605cb0764d13ac58abc5d
SHA512 019e7ab616dd89b1764cddfe89d2cd3414195615e62c2dca200980fac31ce13b5bf33f0b5801c2f2eb27c16f849306a7d9bf2dbbd224ee6beb80f41fd8d0e70d
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 3KB
SHA256 40788006e1a1ef42a7c2739f7e8dd4389efe1a6b107f50580e70e8ebe5f40272
MD5 7b261553ba3c610999059f63c2c8ee6a
SHA1 1f1ae0dc6f3f3e510745074a0455078d33908562
SHA512 a7df1e078a58a39f8b4cb14bacd027825c5ec8a6ca58070dd5e8e98837c1e1fd9206471777f8e144edd43ea380e12259caa5e95b5d77a2deb5fb29a43cdddef1
MD5 SHA1 SHA512

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 833a02f36dfa5affbce525ec3c8ff76f17884fa6f058a31247aae3a5afc4f447
MD5 807032b7314049329ebd06853899378d
SHA1 5b92011b163eb80836c163163d7350731fac9bd8
SHA512 2737573f6f344754cfd0d2562458743608a626fd03e21f728f459f49d2f529b85ae7f4be83cf91f0365e7275681458bf1baefc0e100c46a9ec07fe1638803241
MD5 SHA1 SHA512

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 3KB
SHA256 dad5b6d0b662cfad2be7ff91c9fae6df5560d8c060945c2e500161dec02e7c3d
MD5 9ff44423a176ce26a4c7a07b31228885
SHA1 4fc43105c7c45af784e366d70186909dae5e3d60
SHA512 d650e64ef28bc8da2fcbf686fd1fda891e2d5d4f22ee2bfa69bcba01cd4369eacfcb362f4d8e8f69bab317eaa5b4d0644da0fe5ee5935c9d284ce625ddbcc5bf
MD5 SHA1 SHA512

Submit Download

wct1F1D.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct1F1D.tmp
Size 62KB
SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
MD5 7185e716980842db27c3b3a88e1fe804
SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wctA1E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\wctA1E8.tmp
Size 62KB
SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
MD5 7185e716980842db27c3b3a88e1fe804
SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1304-158-0x0000000003740000-0x0000000004207000-memory.dmp

Download

memory/1304-166-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1304-184-0x0000000003740000-0x0000000004207000-memory.dmp

Download

memory/1304-182-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/1304-140-0x000000000268B000-0x0000000002AF5000-memory.dmp

Download

memory/1304-141-0x0000000002B00000-0x0000000003116000-memory.dmp

Download

memory/1304-142-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/1304-155-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/1304-156-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/1304-157-0x0000000003740000-0x0000000004207000-memory.dmp

Download

memory/1304-143-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/1304-159-0x0000000003740000-0x0000000004207000-memory.dmp

Download

memory/1304-160-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1304-161-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1304-162-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1304-163-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1304-164-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1304-165-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1304-167-0x00000000043D0000-0x0000000004510000-memory.dmp

Download

memory/1680-169-0x00000000029D0000-0x0000000003497000-memory.dmp

Download

memory/1680-170-0x00000000034A0000-0x00000000035E0000-memory.dmp

Download

memory/1680-171-0x00000000034A0000-0x00000000035E0000-memory.dmp

Download

memory/1680-172-0x0000000000A80000-0x0000000001428000-memory.dmp

Download

memory/1680-183-0x00000000029D0000-0x0000000003497000-memory.dmp

Download

memory/1680-181-0x00000000029D0000-0x0000000003497000-memory.dmp

Download

memory/2276-148-0x00000000004C0000-0x00000000004C9000-memory.dmp

Download

memory/2276-185-0x000000000069B000-0x00000000006AC000-memory.dmp

Download

memory/2276-149-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/2276-147-0x000000000069B000-0x00000000006AC000-memory.dmp

Download

memory/3224-134-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/3224-132-0x00000000006FC000-0x000000000070C000-memory.dmp

Download

memory/3224-135-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/3224-133-0x0000000000590000-0x0000000000599000-memory.dmp

Download

memory/4020-152-0x0000000000657000-0x0000000000667000-memory.dmp

Download

memory/4020-153-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4020-154-0x0000000000657000-0x0000000000667000-memory.dmp

Download