80e0db32bbcaefebcc9a7d51aa0fd659c53758a2bcedb2e63f714d6273395c30

Analysis

max time kernel
600s
max time network
564s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Davetrap-4.0.1-win-x64/Davetrap.exe
Size 96.5MB
Sample260804-cw4gcsbe77
SHA256 80e0db32bbcaefebcc9a7d51aa0fd659c53758a2bcedb2e63f714d6273395c30
MD5 000939dc66756fdb819fcc14ff52a8ba
SHA1 947400fbe51bf74512f18d459b23c1b098975191
SHA512 4751a1c755ae94da64206ce0c7a7bc0fc8958e13e783a539d56db05d9fbef32782ae5823691f9134b094f3e177ee309d29f67c3ed104838e21358ee0cfb2ab8b
SSDEEP 1572864:PMIQN5qMkwQSy4PlGLW3OWjTSQ6AUNsNNlwPTLcIFvBKQjuKWRhbW2rXc:PMIGXlLXSfAUC6PX9vRjuKWRhbWGs
TLSH
T154282292A2EC20B8D67AC1788566D11FEB713C1D53246AEB23E0BE193F377D119B9311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
2280	Davetrap.exe
2280	Davetrap.exe
2280	Davetrap.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{F689C68D-3C24-49CD-BBFA-62DE48D1126E}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{E37F1F2B-0024-46BA-A50D-75A46BAEB558}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3884	explorer.exe
3884	explorer.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	Davetrap.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5668	sihost.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3344	StartMenuExperienceHost.exe
3920	SearchHost.exe
3884	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 3884	5668	sihost.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Davetrap-4.0.1-win-x64\Davetrap.exe
"C:\Users\Admin\AppData\Local\Temp\Davetrap-4.0.1-win-x64\Davetrap.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2900

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3884

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Davetrap\ndjAXUZpzIyA\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 320565434e5d8a77e13980e9c0e641daa08d12693ac0d77df9ccf2b25d9e526c
MD5 20d9ebd5020c322365d11bfe49740609
SHA1 0c4248028be99dd04c48428537d98c19b20f12fb
SHA512 05c98a4ae88e305ca02c961526fb7a947036a197ab8d564fa9f530325192233b1285dd3880467db89f3f8a77b84f674c6c1716ad8e62b7b74a4db32d599578b4
SSDEEP 49152:y6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3h/d:yUdeqt737jFmRtF
TLSH
T177268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Davetrap\ndjAXUZpzIyA\PresentationNative_cor3.dll
Size 1.2MB
SHA256 0002f81ee5c803cb90329f2ab08556fd6de29d1ddd6d83446d1d4c19748f25e8
MD5 5abba52442f893f51903867a984309a8
SHA1 935e25fd68702de5b41ffdbd89be7c74e0a35d98
SHA512 63791cb693e4abda219c6f0df951c3b91e8dbc19bf2fb2caec091fa62bca8d91044cba77979e9a690138354676e7cea1a3a320b38b06ab0366d6830092455a99
SSDEEP 24576:agaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPnFR:rnR+g8lYP00OM8zT3GbNUdvoxWZBlIue
TLSH
T163453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Davetrap\ndjAXUZpzIyA\wpfgfx_cor3.dll
Size 1.9MB
SHA256 905625129daab0f6dee6c6d2e95beb47f24590b8d9022392fa4440e9d2957402
MD5 76bb2f5f63ae6f99b58a1a5f0bfbc38e
SHA1 7362d1303d3ae8dd93deeea2e4a43f1894e0d36b
SHA512 705a01621a614656fa8d1013d5413c2044a0e14ca4b912bc6ab7f9133d6447e08d3a633fc727d5adb9ec56efb3dd328f1cc476c38d41c7e1777dd8b7622f390d
SSDEEP 24576:6Iq/d8FBpNk3uQA2F6QB8jObZ7qtiFAdW8SRPTi2A6qTy5IvsEm5b6pSLdZ+c:r3s+QA2SObh9aWd9maqTy5ksEe+c
TLSH
T108954A46B6EC40E9D47AE23CDAD7861BF27178102761A7CF23A0479D6F27BD0097A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2280-5-0x000001F693FF0000-0x000001F694F40000-memory.dmp

Download

memory/2280-9-0x000001F697A80000-0x000001F6989A0000-memory.dmp

Download

memory/2280-25-0x000001F696AE0000-0x000001F696B20000-memory.dmp

Download

memory/2280-37-0x000001F696730000-0x000001F696750000-memory.dmp

Download

memory/2280-41-0x000001F698B10000-0x000001F698B90000-memory.dmp

Download

memory/2280-69-0x000001F698CD0000-0x000001F698CF0000-memory.dmp

Download

memory/2280-65-0x000001F698CA0000-0x000001F698CD0000-memory.dmp

Download

memory/2280-80-0x000001F69BF40000-0x000001F69BF90000-memory.dmp

Download

memory/2280-88-0x000001F69BFC0000-0x000001F69BFF0000-memory.dmp

Download

memory/2280-112-0x000001F69C230000-0x000001F69C250000-memory.dmp

Download

memory/2280-108-0x000001F69C2A0000-0x000001F69C2E0000-memory.dmp

Download

memory/2280-104-0x000001F698D90000-0x000001F698DA0000-memory.dmp

Download

memory/2280-100-0x000001F69C060000-0x000001F69C080000-memory.dmp

Download

memory/2280-97-0x000001F69C170000-0x000001F69C230000-memory.dmp

Download

memory/2280-92-0x000001F69BFF0000-0x000001F69C010000-memory.dmp

Download

memory/2280-84-0x000001F69CA60000-0x000001F69D1D0000-memory.dmp

Download

memory/2280-76-0x000001F69BE40000-0x000001F69BF40000-memory.dmp

Download

memory/2280-61-0x000001F698C10000-0x000001F698C30000-memory.dmp

Download

memory/2280-57-0x000001F698BD0000-0x000001F698BF0000-memory.dmp

Download

memory/2280-53-0x000001F698BB0000-0x000001F698BD0000-memory.dmp

Download

memory/2280-49-0x000001F698A60000-0x000001F698A80000-memory.dmp

Download

memory/2280-45-0x000001F6966C0000-0x000001F6966D0000-memory.dmp

Download

memory/2280-33-0x000001F6995A0000-0x000001F699D90000-memory.dmp

Download

memory/2280-29-0x000001F6989F0000-0x000001F698A40000-memory.dmp

Download

memory/2280-21-0x000001F6966E0000-0x000001F696730000-memory.dmp

Download

memory/2280-17-0x000001F6968F0000-0x000001F696A50000-memory.dmp

Download

memory/2280-13-0x000001F692E80000-0x000001F6930A0000-memory.dmp

Download

memory/2280-124-0x000001F69D740000-0x000001F69D750000-memory.dmp

Download

memory/2280-120-0x000001F69D600000-0x000001F69D640000-memory.dmp

Download

memory/2280-116-0x000001F69D6A0000-0x000001F69D700000-memory.dmp

Download

memory/2280-128-0x000001F69E710000-0x000001F69E7C0000-memory.dmp

Download

memory/2280-132-0x000001F69E830000-0x000001F69E8A0000-memory.dmp

Download

memory/2280-136-0x000001F69EA90000-0x000001F69EBF0000-memory.dmp

Download

memory/2280-141-0x000001F69ECF0000-0x000001F69EDF0000-memory.dmp

Download

memory/2280-144-0x000001F69F070000-0x000001F69F220000-memory.dmp

Download

memory/2280-152-0x000001F69F330000-0x000001F69F3D0000-memory.dmp

Download

memory/2280-148-0x000001F69E8B0000-0x000001F69E930000-memory.dmp

Download

memory/2280-156-0x000001F69F750000-0x000001F69F9C0000-memory.dmp

Download

memory/2280-160-0x000001F6A0EC0000-0x000001F6A1BE0000-memory.dmp

Download

memory/2280-164-0x000001F6A1BE0000-0x000001F6A1F60000-memory.dmp

Download

memory/2280-168-0x000001F6A2140000-0x000001F6A2310000-memory.dmp

Download

memory/2280-178-0x000001F69EE90000-0x000001F69EEB0000-memory.dmp

Download

memory/2280-174-0x000001F69F440000-0x000001F69F4B0000-memory.dmp

Download

memory/2280-182-0x000001F6A00D0000-0x000001F6A0120000-memory.dmp

Download

memory/2280-186-0x000001F6A2400000-0x000001F6A24E0000-memory.dmp

Download

memory/2280-199-0x000001F69F260000-0x000001F69F270000-memory.dmp

Download

memory/2280-195-0x000001F69F250000-0x000001F69F260000-memory.dmp

Download

memory/3920-223-0x0000019B001E0000-0x0000019B002E0000-memory.dmp

Download

memory/3920-251-0x0000019B03C40000-0x0000019B03C60000-memory.dmp

Download

memory/3920-236-0x0000019B13E40000-0x0000019B13F40000-memory.dmp

Download

memory/3920-269-0x0000019B141C0000-0x0000019B141E0000-memory.dmp

Download

memory/3920-235-0x0000019B03A00000-0x0000019B03A20000-memory.dmp

Download

memory/3920-225-0x0000019B001E0000-0x0000019B002E0000-memory.dmp

Download

memory/3920-224-0x0000019B001E0000-0x0000019B002E0000-memory.dmp

Download