danabot | 81dc065d9bbbe3ff88d7d667c933fa4f6f2926f80b279d9d7c0c3b6eec8ba98c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 229KB
Sample221024-hx74tsfcbl
SHA256 81dc065d9bbbe3ff88d7d667c933fa4f6f2926f80b279d9d7c0c3b6eec8ba98c
MD5 7ad6507a7b2d29a69212af37f0384968
SHA1 4b626356da19c2b8d9fb7aceb168c276001e9c33
SHA512 ab9ceefcbc4530603dd48558dbe1c2bb17c5c22812582a93b4e5c14b786ec5b0cb8f0ed466f4c20624a9cad0dfc5cb38d4938f3e07414641067b8bde734f739f
SSDEEP 3072:Fvnoyp4ffH/hLD1Kdhly6vBeAcmuf9czAAFs45MIAkw+Zsl:FvLQJLD14hkeqKzAAFs2Mdk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot nymaim smokeloader backdoor banker bootkit persistence trojan upx

Malware Config

Extracted

Family

danabot

49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535

Attributes

embedded_hash
569235DCA8F16ED8310BBACCB674F896
type
loader

Extracted

Family

nymaim

45.139.105.171
85.31.46.167

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/4880-133-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_smokeloader

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
286	3220	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
2696	2DB7.exe
1380	42A7.exe
2192	48A4.exe
3480	4F5B.exe
1500	jgdsscr

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4732-173-0x0000000004000000-0x000000000408E000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	48A4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pigalicapi = "C:\\Users\\Admin\\pigalicapi.exe"	4F5B.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	42A7.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 4732	3480	4F5B.exe	122
PID 2696 set thread context of 3220	2696	2DB7.exe	144

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

pid	pid_target	Process	procid_target
4388	2192	WerFault.exe	96
4432	2192	WerFault.exe	96
1476	2192	WerFault.exe	96
4356	2192	WerFault.exe	96
4268	2192	WerFault.exe	96
1440	2192	WerFault.exe	96
5032	2192	WerFault.exe	96
3988	2192	WerFault.exe	96
4280	2192	WerFault.exe	96
4044	2192	WerFault.exe	96
4344	2696	WerFault.exe	89
1932	2696	WerFault.exe	89
1644	2696	WerFault.exe	89
4860	2696	WerFault.exe	89
1068	2696	WerFault.exe	89
2132	2696	WerFault.exe	89
5080	2696	WerFault.exe	89
1292	2696	WerFault.exe	89
2928	2696	WerFault.exe	89
5032	2696	WerFault.exe	89

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jgdsscr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jgdsscr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jgdsscr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe

Checks processor information in registry 2 TTPs 44 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2DB7.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2DB7.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	2DB7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2DB7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	2DB7.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	2DB7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1100	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	2DB7.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3048	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4880	file.exe
4880	file.exe
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found
3048	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4880	file.exe
1500	jgdsscr

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	712	svchost.exe
Token: SeShutdownPrivilege	712	svchost.exe
Token: SeCreatePagefilePrivilege	712	svchost.exe
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found
Token: SeShutdownPrivilege	3048	Process not Found
Token: SeCreatePagefilePrivilege	3048	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3220	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3580	OpenWith.exe
3048	Process not Found
3048	Process not Found

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2696	3048	Process not Found	89
PID 3048 wrote to memory of 2696	3048	Process not Found	89
PID 3048 wrote to memory of 2696	3048	Process not Found	89
PID 2696 wrote to memory of 3964	2696	2DB7.exe	91
PID 2696 wrote to memory of 3964	2696	2DB7.exe	91
PID 2696 wrote to memory of 3964	2696	2DB7.exe	91
PID 3048 wrote to memory of 1380	3048	Process not Found	93
PID 3048 wrote to memory of 1380	3048	Process not Found	93
PID 3048 wrote to memory of 1380	3048	Process not Found	93
PID 3048 wrote to memory of 2192	3048	Process not Found	96
PID 3048 wrote to memory of 2192	3048	Process not Found	96
PID 3048 wrote to memory of 2192	3048	Process not Found	96
PID 3048 wrote to memory of 3480	3048	Process not Found	99
PID 3048 wrote to memory of 3480	3048	Process not Found	99
PID 3048 wrote to memory of 3480	3048	Process not Found	99
PID 2192 wrote to memory of 3896	2192	48A4.exe	117
PID 2192 wrote to memory of 3896	2192	48A4.exe	117
PID 2192 wrote to memory of 3896	2192	48A4.exe	117
PID 3896 wrote to memory of 1100	3896	cmd.exe	121
PID 3896 wrote to memory of 1100	3896	cmd.exe	121
PID 3896 wrote to memory of 1100	3896	cmd.exe	121
PID 3480 wrote to memory of 4732	3480	4F5B.exe	122
PID 3480 wrote to memory of 4732	3480	4F5B.exe	122
PID 3480 wrote to memory of 4732	3480	4F5B.exe	122
PID 3480 wrote to memory of 4732	3480	4F5B.exe	122
PID 3480 wrote to memory of 4732	3480	4F5B.exe	122
PID 2696 wrote to memory of 3220	2696	2DB7.exe	144
PID 2696 wrote to memory of 3220	2696	2DB7.exe	144
PID 2696 wrote to memory of 3220	2696	2DB7.exe	144
PID 2696 wrote to memory of 3220	2696	2DB7.exe	144

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4880

C:\Users\Admin\AppData\Local\Temp\2DB7.exe
C:\Users\Admin\AppData\Local\Temp\2DB7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  C:\Windows\system32\agentactivationruntimestarter.exe
  2⤵
  PID:3964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 652
  2⤵
  - Program crash
  PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 928
  2⤵
  - Program crash
  PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 964
  2⤵
  - Program crash
  PID:1644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1124
  2⤵
  - Program crash
  PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1160
  2⤵
  - Program crash
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1160
  2⤵
  - Program crash
  PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 976
  2⤵
  - Program crash
  PID:5080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1304
  2⤵
  - Program crash
  PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1068
  2⤵
  - Program crash
  PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:3220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1444
  2⤵
  - Program crash
  PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Users\Admin\AppData\Local\Temp\42A7.exe
C:\Users\Admin\AppData\Local\Temp\42A7.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1380

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x500
1⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\48A4.exe
C:\Users\Admin\AppData\Local\Temp\48A4.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 452
  2⤵
  - Program crash
  PID:4388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 788
  2⤵
  - Program crash
  PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 804
  2⤵
  - Program crash
  PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 464
  2⤵
  - Program crash
  PID:4356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 448
  2⤵
  - Program crash
  PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 460
  2⤵
  - Program crash
  PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 1000
  2⤵
  - Program crash
  PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 1080
  2⤵
  - Program crash
  PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 1364
  2⤵
  - Program crash
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "48A4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\48A4.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "48A4.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 516
  2⤵
  - Program crash
  PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2192 -ip 2192
1⤵
PID:3156

C:\Users\Admin\AppData\Local\Temp\4F5B.exe
C:\Users\Admin\AppData\Local\Temp\4F5B.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2192 -ip 2192
1⤵
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2192 -ip 2192
1⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2192 -ip 2192
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2192 -ip 2192
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2192 -ip 2192
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2192 -ip 2192
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2192 -ip 2192
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2192 -ip 2192
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2192 -ip 2192
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2696 -ip 2696
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2696 -ip 2696
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2696 -ip 2696
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2696 -ip 2696
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2696 -ip 2696
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2696 -ip 2696
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2696 -ip 2696
1⤵
PID:752

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2696 -ip 2696
1⤵
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2696 -ip 2696
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2696 -ip 2696
1⤵
PID:3404

C:\Users\Admin\AppData\Roaming\jgdsscr
C:\Users\Admin\AppData\Roaming\jgdsscr
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

06e2a386-e288-47d2-9ed4-4891d5859cba.tmp

Path C:\Users\Admin\AppData\Local\Temp\06e2a386-e288-47d2-9ed4-4891d5859cba.tmp
Size 25KB
SHA256 d7089602fa181dfd161165dc1bb34271e7481f88ee2ca06230da2a2269a68c80
MD5 9f670566b87be47f09e3871cd67ed6d9
SHA1 8b49dd7fb4bf06df0a16cfc03a42832b78bdfabd
SHA512 6e53a2d3c4329114f7e562d84bcb6345176ce4d7006c9d699d6dab9886d5aa277b5b8fe5cfb9e574a49e0c1de6414efa913cf9b3ffecd95e9fafa28370fc2456
SSDEEP 768:+MXwy+QbM88WQLzOKTTbgba7CKWaMzrFUJS9ABp5:lXU82OydunFwS9ABp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

2DB7.exe

Path C:\Users\Admin\AppData\Local\Temp\2DB7.exe
Size 8.4MB
SHA256 e79aad276d6cf0cc534558c460bf89513772e3db4687c00680681fa3344db7b9
MD5 3ab690ba30de1f737221f7c3b3a1dc3a
SHA1 14ee7f81582564777a232b49c646279057768dee
SHA512 0781ef29a46ebdef8188d098c51a1a1604b6cc5be3b7dddba5b14a79e7c31f1b011b663920542df1a2f78bc9964d85a8198b8f0082178f33ea2bbee78b940136
SSDEEP 196608:4k5+aZ6IULo36SetI/L26l4SNR7yPvWMQrQ0Mp9s6GZQN+X:ZZ6IULo3etE2AZNR7EzQrQ9p26GZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2DB7.exe

Path C:\Users\Admin\AppData\Local\Temp\2DB7.exe
Size 8.4MB
SHA256 e79aad276d6cf0cc534558c460bf89513772e3db4687c00680681fa3344db7b9
MD5 3ab690ba30de1f737221f7c3b3a1dc3a
SHA1 14ee7f81582564777a232b49c646279057768dee
SHA512 0781ef29a46ebdef8188d098c51a1a1604b6cc5be3b7dddba5b14a79e7c31f1b011b663920542df1a2f78bc9964d85a8198b8f0082178f33ea2bbee78b940136
SSDEEP 196608:4k5+aZ6IULo36SetI/L26l4SNR7yPvWMQrQ0Mp9s6GZQN+X:ZZ6IULo3etE2AZNR7EzQrQ9p26GZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

42A7.exe

Path C:\Users\Admin\AppData\Local\Temp\42A7.exe
Size 549KB
SHA256 fa2667191e8052bcd08f68dcabca3159f29c91a253032389b522d1e0c2fcc7bd
MD5 ab40280cee853b271281479df7f9f21a
SHA1 28978523eafb9dc945979d369e18bb621bf595a7
SHA512 7c0aef4f806819f2b02494dbad572132c788014bb0a08e815c3c2508bc3d55b6ab5aaa91fa1fb0a16673ac59886886b3867ad3a4e25a6cfe986b72a34856a0d5
SSDEEP 12288:dAj1xcUvHIs8vPvTgpyPpkcnjboAV2RIRtNnuusBJQDxlQ6T:du3vHIJTggtnVV2Rmu5Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

42A7.exe

Path C:\Users\Admin\AppData\Local\Temp\42A7.exe
Size 549KB
SHA256 fa2667191e8052bcd08f68dcabca3159f29c91a253032389b522d1e0c2fcc7bd
MD5 ab40280cee853b271281479df7f9f21a
SHA1 28978523eafb9dc945979d369e18bb621bf595a7
SHA512 7c0aef4f806819f2b02494dbad572132c788014bb0a08e815c3c2508bc3d55b6ab5aaa91fa1fb0a16673ac59886886b3867ad3a4e25a6cfe986b72a34856a0d5
SSDEEP 12288:dAj1xcUvHIs8vPvTgpyPpkcnjboAV2RIRtNnuusBJQDxlQ6T:du3vHIJTggtnVV2Rmu5Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

48A4.exe

Path C:\Users\Admin\AppData\Local\Temp\48A4.exe
Size 317KB
SHA256 0db3c21dec09a297e99a07ec1ebd007146adfbcb3c8f0d4a3f88868778c6aef9
MD5 fe62aba35fd5f1c6ca2c1c8be6c27ed3
SHA1 b1912c42ae6742ee1f85be843ad3f66a45372464
SHA512 2d4fedf8c40f2796539a046277ea7f8b6a514e2cecd0b630e8a3a137254a627c873684d247f9e01b53cda4cd36dfa504e9ef1e3c1ed521f9343d45d41032b92a
SSDEEP 6144:fhu1FLTeIjxfniZ5nr6qBgplf95QfGuYjuK2uPbcRItN:fhuXOAfnErgplf3huNuPb0I
MD5 SHA1 SHA512 SSDEEP

Submit Download

48A4.exe

Path C:\Users\Admin\AppData\Local\Temp\48A4.exe
Size 317KB
SHA256 0db3c21dec09a297e99a07ec1ebd007146adfbcb3c8f0d4a3f88868778c6aef9
MD5 fe62aba35fd5f1c6ca2c1c8be6c27ed3
SHA1 b1912c42ae6742ee1f85be843ad3f66a45372464
SHA512 2d4fedf8c40f2796539a046277ea7f8b6a514e2cecd0b630e8a3a137254a627c873684d247f9e01b53cda4cd36dfa504e9ef1e3c1ed521f9343d45d41032b92a
SSDEEP 6144:fhu1FLTeIjxfniZ5nr6qBgplf95QfGuYjuK2uPbcRItN:fhuXOAfnErgplf3huNuPb0I
MD5 SHA1 SHA512 SSDEEP

Submit Download

4F5B.exe

Path C:\Users\Admin\AppData\Local\Temp\4F5B.exe
Size 700KB
SHA256 74b4a1409e686d9b8743ba282776b5498084cd4cecc1e10f1d2fde3ee5f3f401
MD5 d3e225746bf7596be5357ea48802407b
SHA1 664baf3947853ba9c3dc9a9e0edb14d02baa235f
SHA512 ef8576031e7342ef1e947bfd63a7d845b61c82fac96c53bbf65d2a66a2c362d13db484028a4a11ddc1e96e28676a8a77d509976c239e4f56c6d9b712bb5953ba
SSDEEP 12288:hyK3LDODBfZA9d361wKY7JTh6x9cBDVp:1LaTAelCMxqVVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

4F5B.exe

Path C:\Users\Admin\AppData\Local\Temp\4F5B.exe
Size 700KB
SHA256 74b4a1409e686d9b8743ba282776b5498084cd4cecc1e10f1d2fde3ee5f3f401
MD5 d3e225746bf7596be5357ea48802407b
SHA1 664baf3947853ba9c3dc9a9e0edb14d02baa235f
SHA512 ef8576031e7342ef1e947bfd63a7d845b61c82fac96c53bbf65d2a66a2c362d13db484028a4a11ddc1e96e28676a8a77d509976c239e4f56c6d9b712bb5953ba
SSDEEP 12288:hyK3LDODBfZA9d361wKY7JTh6x9cBDVp:1LaTAelCMxqVVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

646a9946-d110-45e4-9694-7f4449423a86.tmp

Path C:\Users\Admin\AppData\Local\Temp\646a9946-d110-45e4-9694-7f4449423a86.tmp
Size 85KB
SHA256 43307d12c1ff7e50bec7e011cc421d07fa2b80c1f62ce25e1c3725cc7758f089
MD5 a5e8325a46bc84636d7db83520e57167
SHA1 4fd6f878b368fc76782805aec08d08e831357769
SHA512 507a692b67de06cc46a7019cd51d2e2b50419a2671d6125f890216f705e6f36424d7ab6b157d3b4bdf40103b1683169329d2d85813611ca179373fa7a1e3875d
SSDEEP 1536:bhbNTdDDvVLO5abkQPFG/uBbX7VxofdNzAzBQPFpgR981Pdqp6yEXwkHEvnLWM:NvXvxtrP/T7VxsnMBUpC8cYgkkvnLWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

84c7bf32-db39-40e7-95b4-e9bdddb0a182.tmp

Path C:\Users\Admin\AppData\Local\Temp\84c7bf32-db39-40e7-95b4-e9bdddb0a182.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

93ae4977-351e-4d12-8e91-5a7da1d83e8a.tmp

Path C:\Users\Admin\AppData\Local\Temp\93ae4977-351e-4d12-8e91-5a7da1d83e8a.tmp
Size 23KB
SHA256 3884df97009ac7e97143743660ed8e010d5f77edcf611bf85276e876fc70754b
MD5 2e0a52964e4f43a9830f01775bcb061b
SHA1 deedc2124380dcc834798466b7ae8ca986aba82f
SHA512 56c28175bfeb1adfa70761dbf3d46f60b3545de1dd879b346658a2701a173c5fd1959dcb6ecb931f7589f8178fa46d026da0edcfef0471f0fc9d65df7bc6ea44
SSDEEP 384:Kf8dqwQFeqz/pS6LK+0DQDIjRdaB9t84OfwSduIf:LMeXJDfK9+4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdobeSFX.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
Size 1KB
SHA256 95803291fa5709ba1a31af43108a7c2746f558534d307adc9ab2ad02fc787ecc
MD5 c98cd13ac41bc5b799af39b201cbd563
SHA1 1852d8094a09243a9f3d773d5894fe7d9b89fd74
SHA512 2f4045c670641d9bdf171de7ebd443ba76646f1fd990bc4046e2b215f8e4e7bba0dd8acbcefbca78bda29aeceff32b60842fd60556801b27cb7dfe3da494fbe8
MD5 SHA1 SHA512

Submit Download

IYMUGYHL-20220901-1118a.log

Path C:\Users\Admin\AppData\Local\Temp\IYMUGYHL-20220901-1118a.log
Size 182KB
SHA256 bbaa20497843b541ff16df5d313d0ae09a07753533de70b364672eff60d919ca
MD5 fc884470343819d1ce5d38d0d731c141
SHA1 3665ddbe5619e9027f0ea87dd58a50177decd9cc
SHA512 fe7a3a1410f83b11023a74b6cbb0b9512ced6111d5a5f33f6247db315901a7d62b9e9e63ea27be44b130dbab0a38fb2f08bb4efd22a509b03593de64f8ff60ae
SSDEEP 1536:94U2r1FUKQpRMDL2TIrL2u7qDvuoxKoy58p8ak09+vdcGGXEi2/ci283irSi29iA:ygAF8tk09+vdcGGUwc5w1/OX/LyDE/tf
MD5 SHA1 SHA512 SSDEEP

Submit Download

StructuredQuery.log

Path C:\Users\Admin\AppData\Local\Temp\StructuredQuery.log
Size 9KB
SHA256 8fe1481584f9267bd08813b456462510663c83320495c7fd0a0bd7be9bda2bf7
MD5 61b1bf4ae2d3acee62ee844ae224f597
SHA1 7f31507bc0f48e45b21b676c02b5aa142a42f9da
SHA512 8f473852e1799945238ab29e3109d578316fa4dd26c785695bfc25e8bf80104da3e0b57f9bfb1ee9be027cc4461fcfc58cfd888e0840c5fa1965685ff7756140
SSDEEP 48:Klx9Vz69T0oXIGXTWGXsP9JEX98TNw9PT78lx9Vz69T0oXIGXTWGXsP9JEX98T4P:NvTlxvTl1vTlxvTlX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Syhidsduo.tmp

Path C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmp
Size 3.3MB
SHA256 db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520
MD5 13d0ff809f24a408728fd6fe00241020
SHA1 fde8484da982eceb86cf6959460ffc4ce33271a9
SHA512 38dd1c523eb9f5aa1c3da0e95f4064f22fc191ce8cea20803c5f60fcbc40d83f5c3545529863ca18f4e65b3ea7a8eddc247ae0db11c6ffa70af560998611e768
SSDEEP 98304:SxlplP5DXkQtCgfAKRToMtYwEh1D33K6m:SxnlRlCg/ToSMDnKr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 72322baaa14f01ab12ba14b00d66e2b2178f3f3d249bb0542a0f49fc59de808c
MD5 e949db8f55991884a153aaf3888575bc
SHA1 e493e81e97c9589339046d5418a5dcf0fab1e660
SHA512 368c7c3f68d8c15ded551ed9b87bc78b79bc0aed7fa3d7ef4006a130c5cf69caec0e5f29962882a5fcaed43580adb2da574cc2c9b178b96d64147b8ecf6ba97c
MD5 SHA1 SHA512

Submit Download

dd_vcredistMSI7626.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI7626.txt
Size 414KB
SHA256 29ae5501fbe82cf6ca45bc724e22db29fe115d5ee4ff67c1fac3055eaec04816
MD5 1665e1695efb8cff7253aa22d3b8d1af
SHA1 bb5cfec3bfdba7957199595d25dc5871ba1e55d9
SHA512 c9abb0bc028617a4152a27ce89a1b92f973d23fcc7cc6d2893c4a714f65ffd36255c9874c5bfacad4d514e7b67ecf5c37dd9cf017a25584c925c9bc490d0e9aa
SSDEEP 1536:o+pGwxXz5N6CtvWxAfib+kFsyJ+cqPz7U/7Bvl7ogIsbrwam9dJ6JxfsOWWoNgSX:o+LcjCGkhu40XywOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI75EB.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI75EB.txt
Size 11KB
SHA256 095ff071270b4125d9b1260caaa26c27d2045fd10245691b72a9132213e74f15
MD5 30641abfdbbbfae51f702a1c8c8ddbef
SHA1 ffcb0ed2708904f75756cc834fe004a0070994d2
SHA512 8edb8eee4e0112d6140ccc7dcbd7cb4acd8c6ffa1625bf537605e144a516ea9596d5a864b91b34ede51f42c0ad6abd1c41557d15a64912502ecea67b8e8d42c3
SSDEEP 192:YL2i1Ej+Y1DnrnjRnrnxMM9nrnQDkT8Vh808IXnv:YL2i1Ej+Y1DrtrxMM9r1woI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI7626.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7626.txt
Size 11KB
SHA256 c1806d15c75249bf5c76a2119add70bc35932fa352195e869336c875729fd91b
MD5 3c93e285f3bbe6e86160089a0a7ecc11
SHA1 8de0d9f28e092e4cc12a343c1a01331b3c83901b
SHA512 027e65e768f04c310b094e9dd029ac59bda27aef30605856336354b5490f0982267a8e5743a15bd7cfebe60dfe169f7c1d8ec7b5b492dd9008a15521023b55b2
SSDEEP 192:RQBt1of6YhXn/nDln/ntM4pnNns/QP8pxDr8VP:RQBt1of6YhX/Z/tM4pNBEMVP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1289b69-6512-49b4-94c5-178649e284db.tmp

Path C:\Users\Admin\AppData\Local\Temp\f1289b69-6512-49b4-94c5-178649e284db.tmp
Size 22KB
SHA256 d6f11c606729d553e9c9b3d0db9e5d51567ea969bedd98008cce7b9415a17490
MD5 99e972f6d63ded5a9f3d6a06ff481bec
SHA1 b3c98ed6975c649454bce3d88806ad1883e22327
SHA512 ecc322a906b25ea835fdfcb528fb0bc11ade80112b9d0783f0c02100a83368b718c45ca5bdbe38c106e3559db7723dc2fdf38e2bf473fb461ddade999d02f416
SSDEEP 384:kP4jVvuNEsXSOS7H02hXspXoIEoUClPgZXhYmosVgSeZfB8/:Q42Eh97HbchoItUOEYsORBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 265KB
SHA256 f68cb61b4540455be8078c8d906eeee3971f2866807a864682dacd3ee01830eb
MD5 1796099a7eaef43649ee0ee72ce45f97
SHA1 dca61a20718c410f7c9295f611ca8a20b4c75c5e
SHA512 c67ee1201697cfcdec547f04989f91ec3fa5abd538b032031d678b64eed8244b98ca776e79de23c55c66bb135ab64e4b0f924a04fb692ac3420f4dd5ba5c4a99
SSDEEP 3072:BKJJ5Mr0G06tgi3Cl+2xd0TMiMiRSyELLhibSmpLWmxtkjM+ciBDmbhgVJdze0j6:v
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 3KB
SHA256 5671ce950a48143b72dccd3de7fb179df6926ac5be63a0b99c5d26907c2cb7a3
MD5 72051cb2a635223b61f1fe158c77671c
SHA1 1a569f9476a5e5f61e9046b564e70332d066616a
SHA512 8ce5303cb3f6fa4af28f75a3774024d8ac25836a6ff45497aba6795bfef0e22a451302580753ff1e736bde5dad0a33e5f3fe75d912643149b1c13188466fae6a
MD5 SHA1 SHA512

Submit Download

wct3A06.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct3A06.tmp
Size 62KB
SHA256 4420111c2dcd4928407eb5dec0c7270d382375392635959c816faf8b50cb95e3
MD5 2e8f497235815362c3d2fe5f4d56010c
SHA1 c6c9c84fbdb7b85261ba818adbc18cab8158d692
SHA512 046993e0cbc526bda57a098cbe3902cc1ee81f90540fadd9004a2ac800b6f37703222986de994a07c175555c51cb641e2f71e9c560b6f174fe039b8dc1217133
SSDEEP 384:poaSLZTSy3m0XoMU9mCzHSti2zu/i49Pji7iJI5TZCP56vS1xDR+diUFv8WTT:WIyptU9mCzHStvu/xV2iP56vcDR+g0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

jgdsscr

Path C:\Users\Admin\AppData\Roaming\jgdsscr
Size 229KB
SHA256 81dc065d9bbbe3ff88d7d667c933fa4f6f2926f80b279d9d7c0c3b6eec8ba98c
MD5 7ad6507a7b2d29a69212af37f0384968
SHA1 4b626356da19c2b8d9fb7aceb168c276001e9c33
SHA512 ab9ceefcbc4530603dd48558dbe1c2bb17c5c22812582a93b4e5c14b786ec5b0cb8f0ed466f4c20624a9cad0dfc5cb38d4938f3e07414641067b8bde734f739f
SSDEEP 3072:Fvnoyp4ffH/hLD1Kdhly6vBeAcmuf9czAAFs45MIAkw+Zsl:FvLQJLD14hkeqKzAAFs2Mdk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jgdsscr

Path C:\Users\Admin\AppData\Roaming\jgdsscr
Size 229KB
SHA256 81dc065d9bbbe3ff88d7d667c933fa4f6f2926f80b279d9d7c0c3b6eec8ba98c
MD5 7ad6507a7b2d29a69212af37f0384968
SHA1 4b626356da19c2b8d9fb7aceb168c276001e9c33
SHA512 ab9ceefcbc4530603dd48558dbe1c2bb17c5c22812582a93b4e5c14b786ec5b0cb8f0ed466f4c20624a9cad0dfc5cb38d4938f3e07414641067b8bde734f739f
SSDEEP 3072:Fvnoyp4ffH/hLD1Kdhly6vBeAcmuf9czAAFs45MIAkw+Zsl:FvLQJLD14hkeqKzAAFs2Mdk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1380-153-0x0000000000400000-0x00000000005E7000-memory.dmp

Download

memory/1380-165-0x0000000000653000-0x00000000006B4000-memory.dmp

Download

memory/1380-152-0x0000000000400000-0x00000000005E7000-memory.dmp

Download

memory/1380-151-0x0000000002240000-0x00000000022AB000-memory.dmp

Download

memory/1380-150-0x0000000000653000-0x00000000006B4000-memory.dmp

Download

memory/1380-170-0x0000000000400000-0x00000000005E7000-memory.dmp

Download

memory/1500-217-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/1500-215-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/1500-214-0x0000000000862000-0x0000000000873000-memory.dmp

Download

memory/2192-168-0x0000000000833000-0x000000000085A000-memory.dmp

Download

memory/2192-162-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/2192-169-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/2192-160-0x0000000000833000-0x000000000085A000-memory.dmp

Download

memory/2192-161-0x0000000000740000-0x0000000000780000-memory.dmp

Download

memory/2696-143-0x0000000000400000-0x0000000000DE1000-memory.dmp

Download

memory/2696-179-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-180-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-181-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-182-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-184-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-185-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-183-0x0000000004D80000-0x0000000005832000-memory.dmp

Download

memory/2696-187-0x0000000000400000-0x0000000000DE1000-memory.dmp

Download

memory/2696-186-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-188-0x0000000005AB0000-0x0000000005BF0000-memory.dmp

Download

memory/2696-216-0x0000000004D80000-0x0000000005832000-memory.dmp

Download

memory/2696-164-0x0000000000400000-0x0000000000DE1000-memory.dmp

Download

memory/2696-178-0x0000000004D80000-0x0000000005832000-memory.dmp

Download

memory/2696-141-0x0000000001133000-0x000000000196E000-memory.dmp

Download

memory/2696-142-0x0000000003310000-0x0000000003CE6000-memory.dmp

Download

memory/2696-175-0x0000000000400000-0x0000000000DE1000-memory.dmp

Download

memory/2696-177-0x0000000004D80000-0x0000000005832000-memory.dmp

Download

memory/2696-176-0x0000000000400000-0x0000000000DE1000-memory.dmp

Download

memory/3220-213-0x00000000035C0000-0x0000000004072000-memory.dmp

Download

memory/3220-192-0x00000000035C0000-0x0000000004072000-memory.dmp

Download

memory/3220-190-0x00000000035C0000-0x0000000004072000-memory.dmp

Download

memory/3220-194-0x0000000004110000-0x0000000004250000-memory.dmp

Download

memory/3220-193-0x0000000004110000-0x0000000004250000-memory.dmp

Download

memory/3220-191-0x00000000010F0000-0x0000000001A82000-memory.dmp

Download

memory/3480-163-0x0000000000600000-0x0000000000616000-memory.dmp

Download

memory/3480-157-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/4732-173-0x0000000004000000-0x000000000408E000-memory.dmp

Download

memory/4732-172-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4732-174-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4880-135-0x0000000000833000-0x0000000000844000-memory.dmp

Download

memory/4880-134-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/4880-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

Download

memory/4880-136-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/4880-132-0x0000000000833000-0x0000000000844000-memory.dmp

Download