Malware Analysis Report

2025-01-22 23:10

Sample ID 241206-p399psyjc1
Target 70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe
SHA256 70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094d
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094d

Threat Level: Known bad

The file 70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload family

Banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (294) files with added filename extension

Renames multiple (197) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-06 12:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-06 12:52

Reported

2024-12-06 12:54

Platform

win7-20240729-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Renames multiple (197) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Core.CustomXMLSchemaCollectionClass" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Assembly = "office, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.Office.Core.CustomXMLSchemaCollectionClass" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "office, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0 C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe

"C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe"

Network

N/A

Files

memory/1820-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1820-1-0x0000000003400000-0x000000000360C000-memory.dmp

memory/1820-8-0x0000000003400000-0x000000000360C000-memory.dmp

memory/1820-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1820-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1820-13-0x0000000003400000-0x000000000360C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

MD5 4133bf22ec06bddc7bc3940c617da4e6
SHA1 d40441c217150b284a72be511e117f3489dcedce
SHA256 db5eccbcd4c155a2ac2875295ad86d469831294b451127d6a9bc7bd98d6b115c
SHA512 243bf8b295cb585c7ae26d39581fe01bf346f454ccc9314949b9c3e3c5d587027d0a24a8249060b6c7118b7a9836c6544adfae4c3e51de7a1f298b8a593ac5ae

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 242202db1fda735f1553f96107a0eaf3
SHA1 543cce8cf4726008b854b7f91bc5682d2873e75d
SHA256 a5a9fec1946ad9c9ec54e99f6ce128d71d6d4ac7e1fb79c8ec5f77795e1d892a
SHA512 1adcbc5495a9f939b965e2bfe45942791cf8337049b590a69cac1316f931f6b4d39165584dd23374ad8b110d71057412ecd7813fbf4a51bfbeaa22106ca6cce2

memory/1820-25-0x0000000003400000-0x000000000360C000-memory.dmp

memory/1820-41-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1820-45-0x0000000003400000-0x000000000360C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-06 12:52

Reported

2024-12-06 12:54

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Renames multiple (294) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\ClearPop.cmd.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\CheckpointBackup.tiff.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "html persistent handler for mapi email" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\PersistentHandler C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\PersistentHandler\ = "{9694E38A-E081-46ac-99A0-8743C909ACB6}" C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe

"C:\Users\Admin\AppData\Local\Temp\70959e24889326fecdd66e6c15a47c61869e04562c5e4e82af8cec7b1e0c094dN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/2696-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2696-2-0x0000000004400000-0x000000000460C000-memory.dmp

memory/2696-9-0x0000000004400000-0x000000000460C000-memory.dmp

memory/2696-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2696-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2696-14-0x0000000004400000-0x000000000460C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp

MD5 42df17c04e193edff9de2dab5f5a3886
SHA1 abe48090d86b4428f2125dd78feeb5a1b0df16c3
SHA256 8228ae18f47e921a9e5941eb8ff105e5414af37022fdab42c20eefcacc541a10
SHA512 38293f1707792bf3cecf80c2743b5de95a67486acdd4c3eb81953f8a9f52e00171d5a67364a776426a594ab126f56c9d5f7ae24356fa1b4f48b0ce234938c48c

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 67aa16605171b4438c9f7fad9bb998e3
SHA1 615fe3f0a33f1cf1e80a3edf2f4dbd0f97404c3a
SHA256 9da58dfd541df1bb971b6fe3f1a6ed24a7ac628e1b831ce1ebd1343ac5116f43
SHA512 4eeefc839a81733da06b2d2cd8f8f1b80685739a641953728871c03436bf5ad98b78aefeeef1ec38ab05b59e64883ea5e4e4b9fe7081ef085a3c132d364f8079

memory/2696-34-0x0000000004400000-0x000000000460C000-memory.dmp

memory/2696-88-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2696-100-0x0000000004400000-0x000000000460C000-memory.dmp