Malware Analysis Report

2025-01-22 23:09

Sample ID 241227-yft4msynak
Target 7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648
SHA256 7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648

Threat Level: Known bad

The file 7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648 was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Renames multiple (195) files with added filename extension

Renames multiple (220) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 19:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 19:44

Reported

2024-12-27 19:45

Platform

win7-20240903-en

Max time kernel

60s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Renames multiple (195) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\mng.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\readme.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\uk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\AssertUninstall.pptx.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%CommonProgramFiles(x86)%\\Microsoft Shared\\DAO\\dao360.dll" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "DAO.User.36" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "DAO.User.36" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "dao, Version=10.0.4504.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "dao.UserClass" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe

"C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe"

Network

N/A

Files

memory/2700-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2700-8-0x0000000003060000-0x000000000326C000-memory.dmp

memory/2700-1-0x0000000003060000-0x000000000326C000-memory.dmp

memory/2700-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2700-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2700-13-0x0000000003060000-0x000000000326C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

MD5 64dbdd38bbd70082dec944ed0c41a82e
SHA1 8ecb418032971789b445740a26e3000886a989a7
SHA256 bd5b7432713d0178e7add174fac6d3b625d7d39649006fae5dd398b691a96d65
SHA512 e38a5c5408991b69a39311dea0551878472a5bbe8be4d01fd13aa8bca33f355a112d263768e2c2fab8d050cccfdebd3697ae38cd3bdf6df845ec9c12b8ef54a5

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 dbef5e2b1df943e7f431803a1b24f03b
SHA1 f61771c9b4f0f66172074c8c5637e50c583f680d
SHA256 175808745e81f5533820d3cbd78d542221dc135af4e47817dbf74253cc48fc08
SHA512 2859d0cf6c4c15dcdff5cf29c566a88768f300a9211374e1f7645a099a28910b65704b4c04d43e60c11add00814e6ef432b60520898f4a601c3df2ab9e3319ba

memory/2700-25-0x0000000003060000-0x000000000326C000-memory.dmp

memory/2700-42-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2700-49-0x0000000003060000-0x000000000326C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 19:44

Reported

2024-12-27 19:45

Platform

win10v2004-20241007-en

Max time kernel

60s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Renames multiple (220) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\va.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "ADODB.Stream" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado15.dll" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "ADODB.Stream.6.0" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "ADODB.Stream" C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe

"C:\Users\Admin\AppData\Local\Temp\7afad58b919f5fa0b7c937744b09f3013d30c8dd538f35d07e83ff62574cf648.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp

Files

memory/4876-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4876-2-0x00000000047B0000-0x00000000049BC000-memory.dmp

memory/4876-9-0x00000000047B0000-0x00000000049BC000-memory.dmp

memory/4876-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4876-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4876-14-0x00000000047B0000-0x00000000049BC000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp

MD5 798946f88be2d7f0434c539a52b2bc9e
SHA1 47d01e5dcb5ac6ffa341d965b07d923cb96c65c4
SHA256 0565f5794da70243716a7ab3fee53d63f4d08159d56da845d482018f37b55629
SHA512 7a52944e1ae9727611949f896eebb3f9b09cd60cd942166c5077022930b3d8fc2bc855e5e05e7f0683b3cf6ff22743b20749eaa6fabe8eaf5430e5770539e89f

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 ef3f826a5c3b4877495cdd9ce8687f7f
SHA1 d0c221fb1ac8e9087aa94331fdfd37ff57be721b
SHA256 9f8904d76d38cb9f064824f79464ee0bbd3d9917bdcaedd1ee8e703cfdd27c45
SHA512 380b483ea98efd57711c558c12db98400f735a3c2fb6e1f5f2e62e846e36f54e082a0ac648b0799dd305ade32e59f4f3458f9eaf8ac3fcc5edd38c2da85b5068

memory/4876-46-0x00000000047B0000-0x00000000049BC000-memory.dmp

memory/4876-47-0x00000000047B0000-0x00000000049BC000-memory.dmp

memory/4876-132-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4876-146-0x00000000047B0000-0x00000000049BC000-memory.dmp