danabot | hxxp://ww

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ww

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
behavioral1/files/0x0009000000023582-697.dat	family_danabot

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow	pid	Process
128	5136	rundll32.exe
143	5136	rundll32.exe
145	5136	rundll32.exe
146	5136	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

Processes:

DanaBot.exe

pid	Process
6132	DanaBot.exe

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exerundll32.exe

pid	Process
2180	regsvr32.exe
5136	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
121	raw.githubusercontent.com
122	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4684	6132	WerFault.exe	134

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

DanaBot.exeregsvr32.exerundll32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{D1AF11FE-5A62-4A90-AB5A-1B1F9AE2FFFF}	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 543422.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	Process
5004	msedge.exe
5004	msedge.exe
4136	msedge.exe
4136	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4744	msedge.exe
4744	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4136 wrote to memory of 1944	4136	msedge.exe	85
PID 4136 wrote to memory of 1944	4136	msedge.exe	85
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 2528	4136	msedge.exe	86
PID 4136 wrote to memory of 5004	4136	msedge.exe	87
PID 4136 wrote to memory of 5004	4136	msedge.exe	87
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88
PID 4136 wrote to memory of 1700	4136	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ww
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7ffbda5446f8,0x7ffbda544708,0x7ffbda544718
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6132
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@6132
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2180
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 460
    3⤵
    - Program crash
    PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16068629344618081661,2060878938413944128,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4ac
1⤵
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6132 -ip 6132
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4829218222c8bedb9ffe89dffd37095

SHA1
aae577f33f413ec3d09f2e7ff5d9cc20a602241c

SHA256
49239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b

SHA512
03e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
15e9c4b4eefb3e1c08a010e748e10f58

SHA1
3172378f2c7a00553ce086dbf53fcf3126c5a724

SHA256
07b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000

SHA512
811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
ed124bdf39bbd5902bd2529a0a4114ea

SHA1
b7dd9d364099ccd4e09fd45f4180d38df6590524

SHA256
48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

SHA512
c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
43KB

MD5
5d9674d3635de7a420d20b74cfbb9d0b

SHA1
64c02c84a46e3b867c8450e599ee1aa31d66c66f

SHA256
73977e7b735626e4892f193331f679740f64ed9f12291e63b8de70523fcf8b64

SHA512
691bd0acafef19aba971f22e877be2071f4b8acb7edd2a18093ec6d5373b4ec76da088ccf6b12ebae5cd3d5b6c3e8a708fa29ee62ec85ce91a6847ea987bde7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
540af416cc54fd550dcdd8d00b632572

SHA1
644a9d1dfcf928c1e4ed007cd50c2f480a8b7528

SHA256
e4e53d750c57e4d92ab9de185bb37f5d2cc5c4fcc6a2be97386af78082115cbb

SHA512
7692e046e49fcde9c29c7d6ea06ed4f16216ec9fb7ea621d3cc4493364743c03925e74244785588d1a4bfc2bedd32b41e7e66e244990d4076e781d7f4bbb270f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cde51a087e02bc07399adc9f652ec24d

SHA1
04f738ce8ea0c3d3fbc170a007098ee6d8d675fb

SHA256
8ab6e01b1c398cae271147892416917ef2734459ba8712fa328505c18d846e4e

SHA512
31ee9f42c7fdf5c9ac53cd9ed0b3650a72f98fdbf9f63bcf93337663ae9f355617c8df4b865d57108f3810cf490fe00482cf660118ff3deff993184f0f5a591f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
df696dd6d1b7616e716099560fadda70

SHA1
23794355a21754e8b36e650a3d3cd3bab06fea7a

SHA256
3710ede7b82ec87e9bad655e71b4cc35c9289d59461c923229024b41b76a51f0

SHA512
02da0b243a772f3d5c258b0a45d08f2b8982eee0b5cbabafc83d0336e0129e7f02b5a1e75e70df715d93757380b1c0ba0f2a27e49d805453a493270a49b6c0e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
939B

MD5
1559f9aac316c4afde671af56d519a70

SHA1
10b741c368b2891972ca14f1687290c7b46d8c32

SHA256
635967d8785b53ff5a994aeaf2bd345501b219487441387c8b80d9279472e71d

SHA512
2e86c6ce2ca8be4000f20624e9261206abc3ebfaa0f60646e0da56628951d8d61a4e0b3a563fbb5fbf66c63bdd228aab93daf124b00ba9261bfcf44be3d02360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b44193a06f71a8c8b075b71e5acb5290

SHA1
23de28f79cc169384290b3515057474ff34f3fa4

SHA256
fc72ac7e6ae262d8ffe4a47f1964aa80d46e460ebf3fe460beb0695df1231198

SHA512
1b5fffc66b6272b726be4c508ebde1825c0a56606fcf15b94755c8b8ffdead88ef7cee1f984815a65adabf0e67dee868bb961557ec808e7756ebf34271169dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
114a52d4db971177ee066abd2dfef282

SHA1
e24358b1b11dcb524610d63099416b60f3625543

SHA256
27d1dd90be0ca6dd0a07195c575d2f2c2db8eddfa9af5c92c36da4bddaf1f0ea

SHA512
47f62350f5b04229fd7fc9f1d3a62323cfe11d3fc7cebbae7da2563e6c0e5c7d71be7518a5908166786917a6f4709b229a5d21b503bb699264a7566f4ab286be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77229763273c4615cd99103599bf7617

SHA1
fba7ad3797d5864f1df5eb3173fe96d393c9104c

SHA256
3cdba93edc9dd25fd35f1418ac286e4e33c3edcdb309bcb1d0776339c01ccc1f

SHA512
53040520ef82af6077382358f6d9e4011997dd1f0c3ff4cfe58007239370287e31262849b17c262fd9a5f45cd2e20199748aaa2818413e8e916b36da572f3bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29e3bb60c6510ad4cca95c04a10a743e

SHA1
08680993aab18555ee2a2de0566e4275f2cb62cd

SHA256
74fde8c3e579f06c41f08fa5574a6124c2c7648359243ad944827406bcb817a6

SHA512
e00d85c463c68ae5c9de8502098fbf9fa1d2dbd5b2fa36ac8405d4adf899d82e1377341ead6b22b7be54d704ec548fba23646097b5432e7ea08d7497183445f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fdf9267a68bc637378acf5242e44c27

SHA1
48be1106b35bc53396a269d1d330c4fcf28e8b2b

SHA256
2a2cff8e6d84d94da2ef0df32aa82fac9bd45f1946bb1b6395deaa5f914b2666

SHA512
d11a90564c042b844cf4697647a73624c5d17982220a9325b3b374906fa0c81dab122b2cddd83ea276ceb36a9a2ca743f9a46189cd8a3063a3df485027ebbd7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
447a9303cdc073ff6c9bc58f8ca49400

SHA1
b386af9bc50d15dfd579ca5286c1af02f07cc9f8

SHA256
a272c9f8189fdf649103b18fb13f8f06d92e2f9fc81c1083dfaf9f75cd1df225

SHA512
c40a6f0cda9b3446ad7db21a37bd04dabdf0b04fb2110e863a6e497db92b336236b42be49c33c8e99a1af87a197e900d42e68845774bb81ef49ff7c52827ceaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0de3c612440114dd860ea4a414dc24ef

SHA1
3afb9cea8239868ec63041ba138ac12861b2884b

SHA256
f8e9a8085ff7289f8897ddaf9db2d92fc4bda78d39ad5faf5f7c338e4c9d8411

SHA512
104c55f1a1d990dff967492b15aba136841153bd1c27fa631762d7513b7545f35c6344fdb68fed7df3f23882f2b0be287125933298d67959e95f4a9af5534831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b733d2595da0e7b902dbe298baef7ae0

SHA1
4041a64bbe477caf72e3d00c0caf782de12a0a08

SHA256
f72521fa60f8804177b67316d19663d6a96c2b8b5ec59a5bef901a73d441e93a

SHA512
a35cfea35493a06c43cd942d1fb42f9936fcb9f6c1df41f4430d309c77de53f9d134b23805ac7a6d4110578e5adaab1108e20e8a2eeb84efdfb02e567efbb9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7915ba0545666aa5833cf9f9f86d45d6

SHA1
743ecc319bc2a54973582d4a5198042a48fbe8db

SHA256
f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20

SHA512
a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f39d450b839714b15864cbdd6fca5d61

SHA1
c849dd36a3b953d9730d01511482fabe81bf266e

SHA256
e1dd6c7f556a28c88a1241a4d6b3d0c89146e8f62646df3a66a4cf8c29e9f2cc

SHA512
5ca6afe59059bdfa3ffff5f74415950f8b790f28e3cc06b862f870576c7505cce059cf83b4c7acd433b2301608001c85ee65c03dd845ed44c47112859c2a31c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
703a88c29fde280c5e0fd34dadf7048a

SHA1
9a3ac75e228a9e5030bc4e9f4c0a5d43b4566b9a

SHA256
dd6f2beceed855b10414ad0ba943980008f5fcc0b8dbe613f0814c1f6142bb08

SHA512
10b92d42ae6b1157fa0e067345b081613cea58829e7a445fa367e52a59c5c66776fe6dd1d477b1b5899d5cee04c7ceabc5e9db6ca47ff8e7c480640584f95c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3381988eba57ed828112963c96fbf12d

SHA1
3b11780d97da01be122bf10255f6c7f15576c4a4

SHA256
1eb280f1e61bbd2916921f7865359c9173bdd820330e08838abe01d585c08045

SHA512
0b17d0de253e2e4ce824505a9d15d8563a1e492f6b3bcd2218986e410e844056f35f3a43e56bf0b590baf3f788beaa5378d98f6f0cb87b989aa80b8c78cce922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586184.TMP

Filesize
538B

MD5
2445ee145314c08e1ae7854e8ab9da9d

SHA1
5836742a5f3fa54b702271ced1f23a1627a6eb78

SHA256
0f6423fec17c356635f70dcb70005db49ef4708e73c93f00ec08ab4a42a816fc

SHA512
d4b435edbaf98fc8c94455c0d5deb5be2ea0adee6aa5d3efdca1d0926e8c40fe0d8f4a7c8f4a3fc824bd8b8c945657fe43036fc2203ec3da7448a106e00f8646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
86af48658fae42d4866d3d387d26a20b

SHA1
c345b283cb882dde7dc297f6ae5f12885f505498

SHA256
3919587f6f6d88b82546a47b3924a828fca4bc69952244a210b528736f41078b

SHA512
dd9d456044dd343c17d4948e4d4268b48958bfd9438a6501d74324f344299bc0a0bda68505f531b41abb54285e2a6b3f9faf4d8e5099f6d64b8129b212cf11ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3cb3b8cb37118e7c235da7b8522de793

SHA1
ebd56b9cb35b99f5b81773103bff792acfd7bec9

SHA256
583917b5ec114015ad68992f9bbed6552c668e2662983864040724361f5cce40

SHA512
f43718040f55fb0ce9553fca259e4000bb8de96bb249a7f0a9236ba24c015add5c63c0233b362473e495deb1363a26b096a287ddf7b96058eaf64de6b67a54aa

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 543422.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
\??\pipe\LOCAL\crashpad_4136_VQLRREVXBAJHURRY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5136-728-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/5136-732-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/6132-709-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download