Malware Analysis Report

2025-03-15 03:54

Sample ID 230803-k8kh1sce67
Target ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c
SHA256 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c
Tags
fatalrat infostealer rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c

Threat Level: Known bad

The file ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c was found to be: Known bad.

Malicious Activity Summary

fatalrat infostealer rat

FatalRat

Fatal Rat payload

Blocklisted process makes network request

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-08-03 09:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-03 09:16

Reported

2023-08-03 09:18

Platform

win7-20230712-en

Max time kernel

120s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"

Signatures

FatalRat

infostealer rat fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Vwxyab.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2244 set thread context of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Vwxyab.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\Vwxyab.exe C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2244 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2244 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\WerFault.exe
PID 2244 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe

"C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 808

C:\Windows\Vwxyab.exe

C:\Windows\Vwxyab.exe

Network

Country Destination Domain Proto
HK 216.83.38.229:80 216.83.38.229 tcp
HK 216.83.38.229:55415 tcp

Files

memory/2244-57-0x0000000003470000-0x0000000003614000-memory.dmp

memory/2684-58-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-59-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-62-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-60-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-64-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2684-68-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-70-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-71-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/2684-72-0x0000000010000000-0x000000001002A000-memory.dmp

C:\Windows\Vwxyab.exe

MD5 ad7b9c14083b52bc532fba5948342b98
SHA1 ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA256 17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512 e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1

memory/2244-80-0x0000000003470000-0x0000000003614000-memory.dmp

memory/2684-81-0x0000000000400000-0x00000000005A4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-03 09:16

Reported

2023-08-03 09:18

Platform

win10v2004-20230703-en

Max time kernel

140s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"

Signatures

FatalRat

infostealer rat fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Vwxyab.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3196 set thread context of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Vwxyab.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\Vwxyab.exe C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe

"C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3196 -ip 3196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1296

C:\Windows\Vwxyab.exe

C:\Windows\Vwxyab.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 126.209.247.8.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
HK 216.83.38.229:80 216.83.38.229 tcp
US 8.8.8.8:53 229.38.83.216.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 161.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
HK 216.83.38.229:55415 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

memory/3196-137-0x0000000003E00000-0x0000000003FA4000-memory.dmp

memory/1792-138-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/1792-140-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/1792-141-0x0000000000400000-0x00000000005A4000-memory.dmp

memory/1792-142-0x0000000010000000-0x000000001002A000-memory.dmp

C:\Windows\Vwxyab.exe

MD5 d0fce3afa6aa1d58ce9fa336cc2b675b
SHA1 4048488de6ba4bfef9edf103755519f1f762668f
SHA256 4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA512 80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

memory/3196-150-0x0000000003E00000-0x0000000003FA4000-memory.dmp

memory/1792-151-0x0000000000400000-0x00000000005A4000-memory.dmp