Analysis Overview
SHA256
efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
Threat Level: Known bad
The file efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 was found to be: Known bad.
Malicious Activity Summary
SystemBC
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Executes dropped EXE
Identifies Wine through registry keys
Checks BIOS information in registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in Windows directory
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-11-13 05:14
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-11-13 05:14
Reported
2022-11-13 05:19
Platform
win7-20220901-en
Max time kernel
204s
Max time network
268s
Command Line
Signatures
SystemBC
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| N/A | N/A | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| N/A | N/A | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\ptbwe.job | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| File opened for modification | C:\Windows\Tasks\ptbwe.job | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
| N/A | N/A | C:\ProgramData\jtfnc\ptbwe.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 836 wrote to memory of 856 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
| PID 836 wrote to memory of 856 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
| PID 836 wrote to memory of 856 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
| PID 836 wrote to memory of 856 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
| PID 836 wrote to memory of 1820 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
| PID 836 wrote to memory of 1820 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
| PID 836 wrote to memory of 1820 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
| PID 836 wrote to memory of 1820 | N/A | C:\Windows\system32\taskeng.exe | C:\ProgramData\jtfnc\ptbwe.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe
"C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe"
C:\Windows\system32\taskeng.exe
taskeng.exe {83A76972-6FAD-4620-A3F9-0347C79D407F} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
C:\ProgramData\jtfnc\ptbwe.exe
C:\ProgramData\jtfnc\ptbwe.exe start2
C:\ProgramData\jtfnc\ptbwe.exe
C:\ProgramData\jtfnc\ptbwe.exe start2
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | cryptotab.me | udp |
| N/A | 23.94.163.16:4001 | cryptotab.me | tcp |
| N/A | 172.217.2.46:80 | 172.217.2.46 | tcp |
Files
memory/1128-54-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/1128-55-0x0000000076961000-0x0000000076963000-memory.dmp
memory/1128-56-0x0000000077D50000-0x0000000077ED0000-memory.dmp
memory/1128-57-0x0000000000400000-0x00000000009C3000-memory.dmp
C:\ProgramData\jtfnc\ptbwe.exe
| MD5 | 3aad6e79569fcc68f0b8530225e08743 |
| SHA1 | e1247952bedea6d68c471b779d673167d5e1d774 |
| SHA256 | efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 |
| SHA512 | b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d |
C:\ProgramData\jtfnc\ptbwe.exe
| MD5 | 3aad6e79569fcc68f0b8530225e08743 |
| SHA1 | e1247952bedea6d68c471b779d673167d5e1d774 |
| SHA256 | efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 |
| SHA512 | b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d |
memory/856-59-0x0000000000000000-mapping.dmp
memory/856-61-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/1128-62-0x0000000077D50000-0x0000000077ED0000-memory.dmp
memory/856-64-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/1128-65-0x0000000077D50000-0x0000000077ED0000-memory.dmp
memory/856-66-0x0000000077D50000-0x0000000077ED0000-memory.dmp
memory/1820-67-0x0000000000000000-mapping.dmp
C:\ProgramData\jtfnc\ptbwe.exe
| MD5 | 3aad6e79569fcc68f0b8530225e08743 |
| SHA1 | e1247952bedea6d68c471b779d673167d5e1d774 |
| SHA256 | efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 |
| SHA512 | b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d |
memory/1820-69-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/1820-71-0x0000000077D50000-0x0000000077ED0000-memory.dmp
memory/1820-72-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/1820-73-0x0000000077D50000-0x0000000077ED0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-11-13 05:14
Reported
2022-11-13 05:19
Platform
win10-20220812-en
Max time kernel
205s
Max time network
268s
Command Line
Signatures
SystemBC
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\ProgramData\fbix\resp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\ProgramData\fbix\resp.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\ProgramData\fbix\resp.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\ProgramData\fbix\resp.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\ProgramData\fbix\resp.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\ProgramData\fbix\resp.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Wine | C:\ProgramData\fbix\resp.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Wine | C:\ProgramData\fbix\resp.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\resp.job | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| File opened for modification | C:\Windows\Tasks\resp.job | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe | N/A |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
| N/A | N/A | C:\ProgramData\fbix\resp.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe
"C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe"
C:\ProgramData\fbix\resp.exe
C:\ProgramData\fbix\resp.exe start2
C:\ProgramData\fbix\resp.exe
C:\ProgramData\fbix\resp.exe start2
Network
| Country | Destination | Domain | Proto |
| N/A | 52.168.117.170:443 | tcp | |
| N/A | 87.248.202.1:80 | tcp | |
| N/A | 8.8.8.8:53 | cryptotab.me | udp |
| N/A | 23.94.163.16:4001 | cryptotab.me | tcp |
| N/A | 172.217.2.46:80 | 172.217.2.46 | tcp |
Files
memory/2016-120-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-121-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-122-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-123-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-124-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-125-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-126-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/2016-127-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-128-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-129-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-130-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-131-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-132-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-133-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-134-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-135-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-136-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-137-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-138-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-140-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-139-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-142-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-141-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-143-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-144-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-145-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-146-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-147-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-148-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/2016-149-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-150-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-151-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-152-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-153-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-154-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-156-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-155-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-157-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-158-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-159-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-160-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-161-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-162-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-163-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-164-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/2016-165-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-167-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-166-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-168-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-169-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-170-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-171-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-172-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-173-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/2016-174-0x0000000076FB0000-0x000000007713E000-memory.dmp
C:\ProgramData\fbix\resp.exe
| MD5 | 3aad6e79569fcc68f0b8530225e08743 |
| SHA1 | e1247952bedea6d68c471b779d673167d5e1d774 |
| SHA256 | efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 |
| SHA512 | b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d |
memory/4652-176-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-177-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-178-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-179-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-180-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-181-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-182-0x0000000076FB0000-0x000000007713E000-memory.dmp
C:\ProgramData\fbix\resp.exe
| MD5 | 3aad6e79569fcc68f0b8530225e08743 |
| SHA1 | e1247952bedea6d68c471b779d673167d5e1d774 |
| SHA256 | efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 |
| SHA512 | b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d |
memory/4652-184-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-185-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-186-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-187-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-188-0x0000000076FB0000-0x000000007713E000-memory.dmp
memory/4652-215-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/4652-220-0x0000000000400000-0x00000000009C3000-memory.dmp
C:\ProgramData\fbix\resp.exe
| MD5 | 3aad6e79569fcc68f0b8530225e08743 |
| SHA1 | e1247952bedea6d68c471b779d673167d5e1d774 |
| SHA256 | efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 |
| SHA512 | b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d |
memory/2224-245-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/2224-263-0x0000000000400000-0x00000000009C3000-memory.dmp
memory/2224-264-0x0000000000400000-0x00000000009C3000-memory.dmp