Malware Analysis Report

2025-03-14 22:56

Sample ID 240406-1srkdscg67
Target e35f361db92f78586661e88a970cd7cb_JaffaCakes118
SHA256 47cbfbf7fbd112dce13b3596823d88533085c7b3e540d833be8a112d47814e79
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

47cbfbf7fbd112dce13b3596823d88533085c7b3e540d833be8a112d47814e79

Threat Level: Shows suspicious behavior

The file e35f361db92f78586661e88a970cd7cb_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Deletes itself

Executes dropped EXE

Registers COM server for autorun

Unexpected DNS network traffic destination

Suspicious use of SetThreadContext

Unsigned PE

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 21:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 21:55

Reported

2024-04-06 21:57

Platform

win7-20240221-en

Max time kernel

65s

Max time network

153s

Command Line

C:\Windows\system32\services.exe

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\services.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-330940541-141609230-1670313778-1000\\$74a77ce9420478f1d9dc8844c507fb6e\\n." C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$74a77ce9420478f1d9dc8844c507fb6e\\n." C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2180 set thread context of 1012 N/A C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\clsid C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-330940541-141609230-1670313778-1000\\$74a77ce9420478f1d9dc8844c507fb6e\\n." C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$74a77ce9420478f1d9dc8844c507fb6e\\n." C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\services.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\services.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\services.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\services.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 j.maxmind.com udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
AR 190.19.72.250:16465 udp
DE 5.146.59.248:16465 udp
US 96.35.239.247:16465 udp
JP 180.12.121.2:16465 udp
US 72.182.103.3:16465 udp
LT 217.147.41.245:16465 udp
US 70.190.24.242:16465 udp
DE 80.171.106.241:16465 udp
BR 189.122.47.4:16465 udp
US 74.131.79.5:16465 udp
IT 95.75.136.236:16465 udp
DE 116.202.116.234:16465 udp
US 207.145.90.5:16465 udp
IT 101.63.148.6:16465 udp
US 173.172.153.7:16465 udp
AU 58.175.4.231:16465 udp
US 96.38.14.230:16465 udp
CA 70.38.11.229:16465 udp
PT 89.214.150.228:16465 udp
RU 95.106.186.7:16465 udp
AR 181.47.12.228:16465 udp
DE 77.21.154.227:16465 udp
US 71.232.34.226:16465 udp
RU 95.221.25.226:16465 udp
US 68.39.238.8:16465 udp
RU 213.110.238.8:16465 udp
US 98.212.238.8:16465 udp
TR 88.249.75.222:16465 udp
US 75.97.210.13:16465 udp
US 76.14.194.14:16465 udp
BR 200.129.166.16:16465 udp
AR 190.188.119.17:16465 udp
FR 78.244.228.17:16465 udp
CA 66.11.167.216:16465 udp
DE 31.25.88.21:16465 udp
CA 64.114.174.215:16465 udp
US 64.188.192.214:16465 udp
US 96.42.94.21:16465 udp
IN 115.187.36.22:16465 udp
US 98.233.37.213:16465 udp
US 50.130.35.212:16465 udp
PL 195.177.86.211:16465 udp
SE 81.229.99.209:16465 udp
BG 178.169.131.22:16465 udp
KR 118.47.199.206:16465 udp
JP 122.29.102.206:16465 udp
IT 87.8.234.205:16465 udp
US 67.9.154.205:16465 udp
NL 24.132.30.205:16465 udp
US 68.106.233.204:16465 udp
US 24.1.190.204:16465 udp
US 173.81.153.204:16465 udp
US 98.222.123.23:16465 udp
RO 188.26.51.203:16465 udp
US 68.172.221.25:16465 udp
DK 109.58.178.26:16465 udp
CA 142.167.247.199:16465 udp
US 76.166.103.28:16465 udp
AU 122.106.153.28:16465 udp
RU 5.164.217.28:16465 udp
US 24.8.168.29:16465 udp
US 129.15.226.196:16465 udp
US 68.110.193.196:16465 udp
US 72.130.123.30:16465 udp
RU 90.151.135.30:16465 udp
SI 85.10.26.192:16465 udp
CA 166.62.239.191:16465 udp
US 67.170.43.191:16465 udp
US 71.123.39.188:16465 udp
US 173.16.44.32:16465 udp
DE 134.93.128.32:16465 udp
IT 79.43.230.185:16465 udp
DE 95.208.106.33:16465 udp
US 174.44.91.185:16465 udp
PL 93.105.135.33:16465 udp
AT 90.146.30.34:16465 udp
SE 95.209.19.182:16465 udp
IN 117.205.83.181:16465 udp
US 74.71.12.181:16465 udp
US 108.167.122.34:16465 udp
US 208.114.43.180:16465 udp
AU 114.76.6.180:16465 udp
US 76.180.196.34:16465 udp
FI 80.186.139.35:16465 udp
CN 114.35.178.35:16465 udp
IN 117.196.225.35:16465 udp
US 173.216.192.176:16465 udp
US 75.87.177.37:16465 udp
HK 124.244.200.37:16465 udp
US 66.115.237.37:16465 udp
RU 5.175.123.175:16465 udp
AU 58.175.129.173:16465 udp
DE 160.45.120.173:16465 udp
IN 116.73.42.38:16465 udp
US 67.162.236.38:16465 udp
US 24.148.8.40:16465 udp
CA 173.178.204.172:16465 udp
US 65.26.125.172:16465 udp
US 68.53.5.171:16465 udp
FR 83.156.4.170:16465 udp
US 68.203.211.167:16465 udp
BR 187.27.124.40:16465 udp
RU 5.1.53.43:16465 udp
US 71.91.109.44:16465 udp
JP 202.239.141.48:16465 udp
CA 184.160.183.164:16465 udp
RU 88.200.162.162:16465 udp
FR 94.238.136.162:16465 udp
US 98.242.23.161:16465 udp
IN 49.204.178.160:16465 udp
US 67.61.161.160:16465 udp
CA 68.69.150.160:16465 udp
FI 87.93.65.153:16465 udp
US 76.108.52.153:16465 udp
HU 79.121.15.153:16465 udp
RU 31.172.131.150:16465 udp
CZ 147.32.113.148:16465 udp
RU 2.95.234.147:16465 udp
US 199.115.185.146:16465 udp
IN 223.191.85.145:16465 udp
CA 24.203.146.142:16465 udp
PT 89.114.16.139:16465 udp
SD 41.241.55.137:16465 udp
US 24.145.9.135:16465 udp
US 75.94.168.134:16465 udp
JP 114.48.166.133:16465 udp
US 24.159.4.131:16465 udp
IN 14.96.148.130:16465 udp
US 98.199.92.130:16465 udp
SE 81.227.196.129:16465 udp
US 174.54.94.129:16465 udp
US 72.152.40.129:16465 udp
HK 182.160.8.129:16465 udp
IN 121.245.7.128:16465 udp
CA 216.65.177.126:16465 udp
JP 180.16.87.126:16465 udp
IN 49.249.127.124:16465 udp
RU 95.105.55.124:16465 udp
US 24.197.20.123:16465 udp
CO 190.147.187.122:16465 udp
RO 188.209.97.122:16465 udp
US 98.30.85.122:16465 udp
KZ 84.240.227.121:16465 udp
US 50.147.152.119:16465 udp
MX 187.241.189.118:16465 udp
RO 78.97.120.118:16465 udp
CA 24.78.198.117:16465 udp
IN 49.249.124.115:16465 udp
JP 114.48.31.114:16465 udp

Files

memory/2180-1-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2180-2-0x00000000004B0000-0x00000000005B0000-memory.dmp

memory/1208-3-0x00000000004B0000-0x00000000005B0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\$74a77ce9420478f1d9dc8844c507fb6e\n

MD5 9e0cd37b6d0809cf7d5fa5b521538d0d
SHA1 411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA256 55d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512 b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5

memory/1208-8-0x0000000002210000-0x0000000002211000-memory.dmp

C:\$Recycle.Bin\S-1-5-18\$74a77ce9420478f1d9dc8844c507fb6e\@

MD5 23f70b47bb46d7960753c180760aa333
SHA1 357a9ac6429616a04a7849d1f0bc0106dd5cce92
SHA256 6fce40ddccd0f914b817a951f8fce6e765a8f882afaef32026491650e603b4bd
SHA512 02a995bf244591970cc5ac66a8a2b3460f0040244b9af3272fbc9dde12f957c9801dd4a48a0d39bd3fac30878020fd1b86f8a377802c77deb57a9cdcb188af79

memory/468-13-0x0000000000030000-0x0000000000031000-memory.dmp

memory/2180-15-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1208-16-0x0000000002210000-0x0000000002211000-memory.dmp

memory/468-17-0x0000000000030000-0x0000000000031000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 21:55

Reported

2024-04-06 21:57

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

157s

Command Line

C:\Windows\Explorer.EXE

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-557049126-2506969350-2798870634-1000\\$aec600a1b2ce8e872f5d86a422888f43\\n." C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 66.85.130.234 N/A N/A
Destination IP 194.165.17.3 N/A N/A
Destination IP 194.165.17.3 N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1388 set thread context of 4480 N/A C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-557049126-2506969350-2798870634-1000\\$aec600a1b2ce8e872f5d86a422888f43\\n." C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\clsid C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e35f361db92f78586661e88a970cd7cb_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe"

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 j.maxmind.com udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
LT 194.165.17.3:53 udp
US 66.85.130.234:53 udp
US 8.8.8.8:53 3.17.165.194.in-addr.arpa udp
US 8.8.8.8:53 234.130.85.66.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp

Files

memory/1388-1-0x0000000000400000-0x000000000042F000-memory.dmp

memory/1388-2-0x0000000000710000-0x0000000000810000-memory.dmp

memory/3320-3-0x0000000000750000-0x0000000000751000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-557049126-2506969350-2798870634-1000\$aec600a1b2ce8e872f5d86a422888f43\n

MD5 9e0cd37b6d0809cf7d5fa5b521538d0d
SHA1 411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA256 55d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512 b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5

memory/3320-7-0x0000000000750000-0x0000000000751000-memory.dmp

memory/1388-10-0x0000000000400000-0x000000000042F000-memory.dmp

memory/3320-11-0x0000000000750000-0x0000000000751000-memory.dmp