4a0b83817f7e10ccaf4f73a8317c132fef767f646b5669e28d509c935910ef79

Analysis

max time kernel
145s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fattura 00384788-0849838.pdf.exe
Size

867KB
MD5

921023d253b6dfac1eaabe38f3b36a45
SHA1

82ae601f2eb5202a5314feffb2a9bd07c5f33327
SHA256

a2deb60615b3bd20beeb9253547a41c0a970139bfb59d9f88854b8b61880ead1
SHA512

86229692b51a24e3f29aec482f6aca2109cf98031011a5bc71b756ee1417fe0200c179bde3adfd9dd72dcb5edd553abb98a5c6845b1c42d3e7672038fb7bc115
SSDEEP

24576:+XH+j3CgxpmJI+QhQ3r+HVqQUEHpGzOUPZ:Jj3CgxpNhN16EHpCx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

dkyedvf.exedkyedvf.exe

pid process

4224 dkyedvf.exe
2320 dkyedvf.exe

pid	process
4224	dkyedvf.exe
2320	dkyedvf.exe

Loads dropped DLL 6 IoCs

Processes:

Fattura 00384788-0849838.pdf.exedkyedvf.exe

pid	process
3272	Fattura 00384788-0849838.pdf.exe
3272	Fattura 00384788-0849838.pdf.exe
3272	Fattura 00384788-0849838.pdf.exe
4224	dkyedvf.exe
4224	dkyedvf.exe
4224	dkyedvf.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

File opened (read-only) \??\F: svchost.exe

description	ioc	process
File opened (read-only)	\??\F:	svchost.exe

Drops file in System32 directory 56 IoCs

Processes:

dkyedvf.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.source.name.profile.enabled.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\html.ext.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\LICENSE_en_US.txt	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\use.id.as.filename.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\brzphon.env	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\page.width.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\use.role.as.xrefstyle.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\manifest.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\qanda.title.level3.properties.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Warm Gray 11 bl 3.ADO	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\CurveFitting.vbw	dkyedvf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\SequenceFrequency.mm	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\xslthl-config.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\NsResize.dll	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\16ps.png	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\25.svg	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\LoadLayers.exv	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\49-sansserif.conf	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\multiframe.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\pass.png	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\P_AutoAlign_Interactive_87x38.png	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.generate.name.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ExampleXML2PDF.java	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\South_Georgia	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\VsUntexturedInstanced.hlsl	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\variablelist.max.termlength.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\f20.png	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tweakBIOSDriversFirmwareUpdate_ru.p5p	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\qanda.title.level2.properties.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Bosun.mNa	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\htmlhelp.use.hhk.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\slvphon.env	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\root.properties.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\g1_1366 x 768 px 72 ppi.IMZ	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\DuelOmmatidium.Jsg	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\g2_Letter 8.5 x 11 in 300 dpi.IMZ	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\setup.iss	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Ext-RKSJ-V	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\pcdrsound.p5m	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\inventory_3.png	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\htmlhelp.title.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\README-en	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\green 3405 bl 4.ADO	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Sydney	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.separator.xml	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Kiev	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\BMY brown 2.ADO	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\PSNormalMap.hlsl	dkyedvf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\cations	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\README_kn_IN.txt	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GMT+8	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Windows.act	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\default_hash.js	dkyedvf.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\green 349 bl 1.ADO	dkyedvf.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Fattura 00384788-0849838.pdf.exedkyedvf.exe

description	pid	process	target process
PID 3272 set thread context of 2144	3272	Fattura 00384788-0849838.pdf.exe	Fattura 00384788-0849838.pdf.exe
PID 4224 set thread context of 2320	4224	dkyedvf.exe	dkyedvf.exe

Drops file in Windows directory 2 IoCs

Processes:

dkyedvf.exeFattura 00384788-0849838.pdf.exe

description ioc process

File opened for modification C:\Windows\ dkyedvf.exe
File opened for modification C:\Windows\ Fattura 00384788-0849838.pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3104 2320 WerFault.exe dkyedvf.exe
1960 2320 WerFault.exe dkyedvf.exe

description	ioc	process
File opened for modification	C:\Windows\	dkyedvf.exe
File opened for modification	C:\Windows\	Fattura 00384788-0849838.pdf.exe

pid	pid_target	process	target process
3104	2320	WerFault.exe	dkyedvf.exe
1960	2320	WerFault.exe	dkyedvf.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe	nsis_installer_2

Modifies data under HKEY_USERS 23 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00610038006600350064006500360036002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00610038006600350064006500360036002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000}	svchost.exe

Modifies registry class 32 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082416847439"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082428722526"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082099191501"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133579883954402836"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590083158253856"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082082785528"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082423253689"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082758566541"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082757472467"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082768410047"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590083155441354"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082433097517"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133579883957059138"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082746847558"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082775129047"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590083157159953"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590083165128992"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Fattura 00384788-0849838.pdf.exedkyedvf.exe

pid	process
2144	Fattura 00384788-0849838.pdf.exe
2144	Fattura 00384788-0849838.pdf.exe
2320	dkyedvf.exe
2320	dkyedvf.exe
2320	dkyedvf.exe
2320	dkyedvf.exe
2320	dkyedvf.exe
2320	dkyedvf.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

dkyedvf.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2320	dkyedvf.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

Fattura 00384788-0849838.pdf.exedkyedvf.exedkyedvf.exesvchost.exe

description	pid	process	target process
PID 3272 wrote to memory of 2144	3272	Fattura 00384788-0849838.pdf.exe	Fattura 00384788-0849838.pdf.exe
PID 3272 wrote to memory of 2144	3272	Fattura 00384788-0849838.pdf.exe	Fattura 00384788-0849838.pdf.exe
PID 3272 wrote to memory of 2144	3272	Fattura 00384788-0849838.pdf.exe	Fattura 00384788-0849838.pdf.exe
PID 3272 wrote to memory of 2144	3272	Fattura 00384788-0849838.pdf.exe	Fattura 00384788-0849838.pdf.exe
PID 3272 wrote to memory of 2144	3272	Fattura 00384788-0849838.pdf.exe	Fattura 00384788-0849838.pdf.exe
PID 3272 wrote to memory of 2144	3272	Fattura 00384788-0849838.pdf.exe	Fattura 00384788-0849838.pdf.exe
PID 4224 wrote to memory of 2320	4224	dkyedvf.exe	dkyedvf.exe
PID 4224 wrote to memory of 2320	4224	dkyedvf.exe	dkyedvf.exe
PID 4224 wrote to memory of 2320	4224	dkyedvf.exe	dkyedvf.exe
PID 4224 wrote to memory of 2320	4224	dkyedvf.exe	dkyedvf.exe
PID 4224 wrote to memory of 2320	4224	dkyedvf.exe	dkyedvf.exe
PID 4224 wrote to memory of 2320	4224	dkyedvf.exe	dkyedvf.exe
PID 2320 wrote to memory of 780	2320	dkyedvf.exe	svchost.exe
PID 780 wrote to memory of 2020	780	svchost.exe	DllHost.exe
PID 780 wrote to memory of 2020	780	svchost.exe	DllHost.exe
PID 780 wrote to memory of 4860	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4860	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4860	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 5036	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 5036	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 5036	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4152	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4152	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4152	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4568	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4568	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4568	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 3304	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 3304	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 3304	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 1796	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1796	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1796	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4140	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4140	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4140	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4552	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4552	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4552	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 1800	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1800	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1800	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4444	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4444	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4444	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 2976	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 2976	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 2976	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 436	780	svchost.exe	BackgroundTaskHost.exe
PID 780 wrote to memory of 436	780	svchost.exe	BackgroundTaskHost.exe
PID 780 wrote to memory of 436	780	svchost.exe	BackgroundTaskHost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:2020

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:4860

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:5036

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:4152

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:4568

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:3304

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:1796

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:4140

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:4552

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:1800

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:4444

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:2976

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
2⤵
PID:436

C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3272

C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2144

C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4224

C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 636
3⤵
- Program crash
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 652
3⤵
- Program crash
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 2320
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2320 -ip 2320
1⤵
PID:216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\suaiuka
Filesize
654B

MD5
2d18045636569317c440a98a1dfe8924

SHA1
76c687fb67972b8f2e7277351b410f1270312a1a

SHA256
e97e45480be43f772878c2624d1548f2b6ad25db626a4ecdcd75285a3c8e810e

SHA512
6446c99a4f511415145a3888398557edd4197b65823382a34efb6aa4011e1a92a91553e96a3502e39833ef74c9955d08ab79040d73bb39b4aad24d4348ed56df

Download Submit
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe
Filesize
867KB

MD5
921023d253b6dfac1eaabe38f3b36a45

SHA1
82ae601f2eb5202a5314feffb2a9bd07c5f33327

SHA256
a2deb60615b3bd20beeb9253547a41c0a970139bfb59d9f88854b8b61880ead1

SHA512
86229692b51a24e3f29aec482f6aca2109cf98031011a5bc71b756ee1417fe0200c179bde3adfd9dd72dcb5edd553abb98a5c6845b1c42d3e7672038fb7bc115

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb3190.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
C:\Users\Admin\AppData\Roaming\LICENSE_en_US.TXT
Filesize
2KB

MD5
00d7ffb88aeb3f3fa5ae3178591139ef

SHA1
b5edc99a205912d98207c1314d696dfe48192118

SHA256
f8dfac00ca2636f16dbb824c1626a607308bb582356fb736d1ee3f5f2656d861

SHA512
03e9df7a1cd6b214b03830b184bf0e7c0abb48da36a184402f2bb3590991bb027cff95cc8751d83cb5c7f7fcddc6969e746056a307d30cfc9fe937010f9a4fa7

Download Submit
C:\Users\Admin\AppData\Roaming\NsResize.dll
Filesize
60KB

MD5
9c655b0c142db0494026c1ebb1b3923f

SHA1
2dbebe42968e78200688e40ab5b8d25bf8e0b4df

SHA256
ef2d114896f07fc20aed5c3045754de0103813aa31bedb188262cec6fb3263dd

SHA512
51d7efab18f6909daf61534befa2e20eec437c24114f7c21b383004806d4b8869dc12395a972965c89dbeb66fe0282833207b5aa93ec7f085ca7054d0a0d9f1d

Download Submit
C:\Users\Admin\AppData\Roaming\README_kn_IN.TXT
Filesize
409B

MD5
ade6c65fd0eeb73a60e279fdc7da023b

SHA1
4af90b3176b51d1e70e5561e27a2a2fd2277edcb

SHA256
56c2ecc106829db1020d48fe49a4802a4ee24875a8a873fff86ff0c413a3e226

SHA512
6bce13814640b256b83fa54b9d8df0e34076734baaa090b9aa433eefff87324b6782dd36567ea1c231480714c15df30dafb0cc665ea8194c1ada2f956ec0b83e

Download Submit
C:\Users\Admin\AppData\Roaming\default_hash.JS
Filesize
136B

MD5
06a09bda9d5dd7dba611b2dd460d545e

SHA1
73946d0150e298464b8a55a107bb22be6368029c

SHA256
c062646586359c92950920a9e5a51bcec73afeb863dc01337a88adadc789f05e

SHA512
b104418ebc3eabf7a3d4aae3a23bdeea63d0118f56397e3763318397baa0b59ed5756a354a922c2c6206636ab761197e379e6fa5b4aa7cf2a60c24416a2ad459

Download Submit
C:\Users\Admin\AppData\Roaming\setup.ISS
Filesize
241B

MD5
698f513c0c9d50ac789cfbe4bde1b467

SHA1
122acd3c51b72fc2bf4dc556cac09f9e6c6445fa

SHA256
f19b204261a5524ed3f5204fbd01d91f06fe1b2181b2fa2c2c7629ccb4e54b16

SHA512
c2b5ef941d332d2faa780d044ee5fee6f59d7852e5b0a5974fa47c9b9f03c2b3d867423004eae788ac765f30dbe65bc3b71cd9b679b1ff5dee78eb8fc82f41fc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm
Filesize
684B

MD5
7d3be2ec810fa01a9ea7d2a26551cff7

SHA1
7962465ce36a83666fe7a3edcb31e125ed597e93

SHA256
1a5660f3f8bb9d18fd6a710d70af26cf1e167fe040d7daf3ce41e527236e1fec

SHA512
cd4ba616364f37aa8294c9a2a6b64ed3cf0b011cfcffa9056295b5fc23348c2b3cfa96a25954c6dc472053daa1f9f4b08176a515c95abab6ffd7077deb8d7959

Download Submit
memory/780-177-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-188-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-3525-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-155-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-158-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-163-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-161-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-370-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/780-157-0x00000000390B0000-0x0000000039127000-memory.dmp

Filesize
476KB

Download
memory/2144-72-0x0000000000400000-0x00000000004A4600-memory.dmp

Filesize
657KB

Download
memory/2144-73-0x00000000009B0000-0x0000000000BFB000-memory.dmp

Filesize
2.3MB

Download
memory/2144-71-0x0000000000790000-0x00000000009AA000-memory.dmp

Filesize
2.1MB

Download
memory/2144-70-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2144-68-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2320-152-0x00000000008A0000-0x0000000000AEB000-memory.dmp

Filesize
2.3MB

Download
memory/3272-64-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/4224-141-0x0000000001BB0000-0x0000000001BC0000-memory.dmp

Filesize
64KB

Download