Malware Analysis Report

2025-06-16 01:47

Sample ID 240406-sfxxmsde57
Target e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118
SHA256 71d3b36be058908e96750ba536922bb0748c3b3dabe78dfc9276bed4b01ea0e6
Tags
redline sectoprat @kypidss infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71d3b36be058908e96750ba536922bb0748c3b3dabe78dfc9276bed4b01ea0e6

Threat Level: Known bad

The file e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

redline sectoprat @kypidss infostealer rat trojan

RedLine payload

SectopRAT

RedLine

SectopRAT payload

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Views/modifies file attributes

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 15:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 15:04

Reported

2024-04-06 15:07

Platform

win10v2004-20231215-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3464 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 3464 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 2160 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2160 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2160 wrote to memory of 4592 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 4592 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3544 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3544 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 1948 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 1948 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3952 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3952 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3728 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3728 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 1444 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 1444 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3872 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 3872 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 4012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 4012 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2160 wrote to memory of 1556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2160 wrote to memory of 1556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2160 wrote to memory of 1852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe
PID 2160 wrote to memory of 1852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe
PID 2160 wrote to memory of 1852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e file.zip -p -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_9.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_8.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_7.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_6.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_5.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_4.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_3.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "@Kypidss.exe"

C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe

"@Kypidss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 45.14.49.109:21295 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
NL 45.14.49.109:21295 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
NL 45.14.49.109:21295 tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
NL 45.14.49.109:21295 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp

Files

C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd

MD5 3d6f2c801b9db9dc925340fe9536a3d7
SHA1 5668f9f7531fd6e54b2be62dcd2a6386e0b8844a
SHA256 71d710c4d18688543cf824b147e904de2525cd725c977680693b1f45ac4cf549
SHA512 65418c25c2377993135f5909806102d641379fdd1ecaea9d6f98c4141b4f6a6f23f23e6f9c110e46c9479f71dbbe985d15a93146db533e35671669678ec1e337

C:\Users\Admin\AppData\Local\Temp\svchost\payload.data

MD5 e79e2a61063b7bc37428241f10b65547
SHA1 b80195593d61983442d5b558cd802a175d21da9a
SHA256 6a627f0efbdc9cc0ebc0fcad4ce97079c26f4b6fe82306f6028edc9db1bd6a13
SHA512 ffe5db607d72bc779678c7adb1e3104c3a06f13b176d7b692ff9262d459b869d878f1f0f77e1e5eae67e13ebea52d9b50cd53ee9acd2f965d1fce57f1f0410ee

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_9.zip

MD5 da41aef5b2e0a6779d333d3de7b02fb6
SHA1 0997c325ca6d090d4bf80d8dbf85b3f3687238ce
SHA256 b5f6b7a15e2f5d575da70e202c88a84a2d12f0128eb29885545e8e620c853930
SHA512 a1b001bc60c641cd6a3475eed33b9b663ee5e1a0184c8f92b462c5c286ceb62e19918dcad6a7d57eacbf859fd5bc9cb41b298034621695e80fc5be5dfb6f0eb1

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_8.zip

MD5 7558a4fa8de4a19e9ec071f1782a7de9
SHA1 6c4f3db4641fb6b276c0d66796fbfa57ad52c3d2
SHA256 9c78566c25906ad8bcf1acb24c9db492a025cca84dfabf461b6d7be6c2bbdf1e
SHA512 02d711475e42dd8f563e82a1fbaf1dffcb70495d6a1219846415e718049105492fcc86462af0aa92ee6387290ed0e5d991f8fb9e3900c10c9b68c424579f4874

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_7.zip

MD5 eadc28732020b3319b7d7c4fd6aa72bb
SHA1 1f41c976ae6c8d96bf21f5b0b04681bbb2e7eeed
SHA256 7f60367638ee68732ab3abf752612fcea95ac78ec8087aff768aee4fe559dd5c
SHA512 0b290a0b760b36c760b21e7f6436ffc75ed45d5045a8dd8ab4b67c8630993a696c8c9b813ce7a2bbb6d15212f6a640a23a43c31e30533b4215a77162af0b38f1

C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe

MD5 6feb31e3fbfadaf1029223c60bc0d60c
SHA1 13555e90f6bd008c03403e09fcd17d6a65ab461f
SHA256 b059aaa7da26904746289493bcc558f552408b0a4df2e86ff8ed0c675f4dc23e
SHA512 5680e753eb00386413fa4352a9169b6a0d1eb13b6ae5fe9c167e9999d40634d9318fe2bc91c6f76df22f00e0dc174fc38207a601024bf9f3093e71924eef44cb

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\ANTISC~1.DAT

MD5 029d8f9ffcbaa8d159537ecb51b8b40d
SHA1 bc67ac7339d5f92f5f8b82914570346a7726ad56
SHA256 a517d9a37af067b1135f901ef24a4569e810aeddbedc188be70eb25ce865a5d9
SHA512 5d6d169ba7c674356c1062ffcea5cf003b1ec00c7c9172f981d194a067cb72869311f107b8a18aa4c964d8d97852212fb7c76a6a9ef7c737d8f6841f17f7e7dd

memory/1852-77-0x0000000000F20000-0x0000000000F3E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_1.zip

MD5 1410f52a4450065eda4ff0e4384d4d87
SHA1 91b3aca68b974f7f227a19d5193abc41ab1fb57f
SHA256 566729a30e9eb2ec17855aa0bca0b68bb6e239067725f05b4fcbb10c1e9ea851
SHA512 07eb18849cd6247b16a4eb48e55dce3a8212c318ac13ca04bb40d0daa59c33ddffbe836975c10263e991183c2f24564df1cd51980239a935ebf81f49fa34bb53

memory/1852-79-0x00000000058E0000-0x00000000058F2000-memory.dmp

memory/1852-78-0x0000000006080000-0x0000000006698000-memory.dmp

memory/1852-80-0x0000000005940000-0x000000000597C000-memory.dmp

memory/1852-81-0x0000000005980000-0x00000000059CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_2.zip

MD5 eb3589a039e50801ccedbdc2fe019213
SHA1 db1689b29d5a18d0a39c4c2cab8969c5cd54b67e
SHA256 d688fa7f2429ca3047284470660bc28b75209f3451b1b50eda6e8a75a970c0d5
SHA512 d452d0b63aea51e77fba2726d76824607750299ccbe3fdb73373339ea392a30d0deae8864bb9624340c635255f194558350d223fb04c1c03992e2d9e07aca4fe

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_3.zip

MD5 cd3a07e4b4503ca247db22d431c9c34c
SHA1 17fdfa18284b4f8d37ae78b3ae8c42f0b4626dea
SHA256 56c9586c32b71bb2d92e8dd80ac79e764f05d88ccdef4f6113686e99ca928cb4
SHA512 3fdfb94dee436ee7062f3ac6c1cd3699cdb845ddd820626b2e46c362ad978001ec05cc34532b6bacc3ed7c97304b6c0bb20d1ce0cfa3b9e3d293aa58ca231466

memory/1852-82-0x0000000005BF0000-0x0000000005CFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_4.zip

MD5 121bbc518d0197533acad96be6912689
SHA1 88ecc86c2a4e3a3e4f3cd6e76856ecfa24c9dac7
SHA256 61f5e438ad11b778bfa9536deb946982febece34cfd2adbaa374b2e20a06b149
SHA512 5afc6c5f2567bf50734be6f5f1416d7b538a9848c17928ada4498567a13235af7b5b3d65c5b6e6f876f9de91d96e09ce4c6ffbe10fcc6672fa77c4f9540cf228

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_5.zip

MD5 6c4fe4407cbe541fbad8fe96caa4cd8c
SHA1 66e09294d336eeebbc632f5cd11e63f078c1492b
SHA256 b6be02309134d09336a28d03812a98a61cb1e43b8458c258f39a70477b69a0e6
SHA512 3415ef2f80113c8424092f8404da3aa97adc5463a5acfc6475b41048c7b09b2d712a5f31689b5854ee7c7971721cd3e2576b8366cf6d62878973fe4c3af5597e

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_6.zip

MD5 99cf0c2d1b2b4ea537117cfbfe2f2fbb
SHA1 485799f1c051b1f9fa46cbbb7a9466e8a82fc8d5
SHA256 c9e503e701e324f2803ed62b8522e6170c1ddba75d025c90df1240e79837ac46
SHA512 e9cfd12ad34ac9781cb1ac1f76971b92cc2ba857b49d2eea3c9de6ba18c716ca7b489ef170a053d064d5a1c672174617624b6911de5e70d5f3b7b25d1bd5d7cc

memory/1852-83-0x0000000072B60000-0x0000000073310000-memory.dmp

memory/1852-84-0x0000000005A50000-0x0000000005A60000-memory.dmp

memory/1852-85-0x0000000072B60000-0x0000000073310000-memory.dmp

memory/1852-86-0x0000000005A50000-0x0000000005A60000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 15:04

Reported

2024-04-06 15:07

Platform

win7-20240221-en

Max time kernel

142s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2808 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 2808 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 2808 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 2808 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 2844 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2844 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2844 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 2844 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2716 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2660 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2596 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2480 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 1808 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 1808 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 1808 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
PID 2844 wrote to memory of 2592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2844 wrote to memory of 2592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2844 wrote to memory of 2592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2844 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe
PID 2844 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe
PID 2844 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe
PID 2844 wrote to memory of 2680 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e2cdbe43745e8ef737fded5c21bfd162_JaffaCakes118.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e file.zip -p -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_9.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_8.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_7.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_6.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_5.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_4.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_3.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "@Kypidss.exe"

C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe

"@Kypidss.exe"

Network

Country Destination Domain Proto
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp
NL 45.14.49.109:21295 tcp

Files

C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd

MD5 3d6f2c801b9db9dc925340fe9536a3d7
SHA1 5668f9f7531fd6e54b2be62dcd2a6386e0b8844a
SHA256 71d710c4d18688543cf824b147e904de2525cd725c977680693b1f45ac4cf549
SHA512 65418c25c2377993135f5909806102d641379fdd1ecaea9d6f98c4141b4f6a6f23f23e6f9c110e46c9479f71dbbe985d15a93146db533e35671669678ec1e337

C:\Users\Admin\AppData\Local\Temp\svchost\payload.data

MD5 e79e2a61063b7bc37428241f10b65547
SHA1 b80195593d61983442d5b558cd802a175d21da9a
SHA256 6a627f0efbdc9cc0ebc0fcad4ce97079c26f4b6fe82306f6028edc9db1bd6a13
SHA512 ffe5db607d72bc779678c7adb1e3104c3a06f13b176d7b692ff9262d459b869d878f1f0f77e1e5eae67e13ebea52d9b50cd53ee9acd2f965d1fce57f1f0410ee

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_9.zip

MD5 da41aef5b2e0a6779d333d3de7b02fb6
SHA1 0997c325ca6d090d4bf80d8dbf85b3f3687238ce
SHA256 b5f6b7a15e2f5d575da70e202c88a84a2d12f0128eb29885545e8e620c853930
SHA512 a1b001bc60c641cd6a3475eed33b9b663ee5e1a0184c8f92b462c5c286ceb62e19918dcad6a7d57eacbf859fd5bc9cb41b298034621695e80fc5be5dfb6f0eb1

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_8.zip

MD5 7558a4fa8de4a19e9ec071f1782a7de9
SHA1 6c4f3db4641fb6b276c0d66796fbfa57ad52c3d2
SHA256 9c78566c25906ad8bcf1acb24c9db492a025cca84dfabf461b6d7be6c2bbdf1e
SHA512 02d711475e42dd8f563e82a1fbaf1dffcb70495d6a1219846415e718049105492fcc86462af0aa92ee6387290ed0e5d991f8fb9e3900c10c9b68c424579f4874

\Users\Admin\AppData\Local\Temp\svchost\7z.dll

MD5 56a9726d8e4f6a97cf68517c7a23ebd7
SHA1 cff2afde0437c07f76ace54fc57a52b1208a7c98
SHA256 6857e1bc8743a6682745525ba6767fc8a3da09162ca85f95d63dd48baa077d0c
SHA512 94d2bebf8c142e051aae4124586a5f316e22c722832cf2138f534171594af72db941e48ddf9c0eb627faa62232bc84a4197adc0cb3a38c02b91615df06da44b0

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_7.zip

MD5 eadc28732020b3319b7d7c4fd6aa72bb
SHA1 1f41c976ae6c8d96bf21f5b0b04681bbb2e7eeed
SHA256 7f60367638ee68732ab3abf752612fcea95ac78ec8087aff768aee4fe559dd5c
SHA512 0b290a0b760b36c760b21e7f6436ffc75ed45d5045a8dd8ab4b67c8630993a696c8c9b813ce7a2bbb6d15212f6a640a23a43c31e30533b4215a77162af0b38f1

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_6.zip

MD5 99cf0c2d1b2b4ea537117cfbfe2f2fbb
SHA1 485799f1c051b1f9fa46cbbb7a9466e8a82fc8d5
SHA256 c9e503e701e324f2803ed62b8522e6170c1ddba75d025c90df1240e79837ac46
SHA512 e9cfd12ad34ac9781cb1ac1f76971b92cc2ba857b49d2eea3c9de6ba18c716ca7b489ef170a053d064d5a1c672174617624b6911de5e70d5f3b7b25d1bd5d7cc

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_4.zip

MD5 121bbc518d0197533acad96be6912689
SHA1 88ecc86c2a4e3a3e4f3cd6e76856ecfa24c9dac7
SHA256 61f5e438ad11b778bfa9536deb946982febece34cfd2adbaa374b2e20a06b149
SHA512 5afc6c5f2567bf50734be6f5f1416d7b538a9848c17928ada4498567a13235af7b5b3d65c5b6e6f876f9de91d96e09ce4c6ffbe10fcc6672fa77c4f9540cf228

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_3.zip

MD5 cd3a07e4b4503ca247db22d431c9c34c
SHA1 17fdfa18284b4f8d37ae78b3ae8c42f0b4626dea
SHA256 56c9586c32b71bb2d92e8dd80ac79e764f05d88ccdef4f6113686e99ca928cb4
SHA512 3fdfb94dee436ee7062f3ac6c1cd3699cdb845ddd820626b2e46c362ad978001ec05cc34532b6bacc3ed7c97304b6c0bb20d1ce0cfa3b9e3d293aa58ca231466

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_1.zip

MD5 1410f52a4450065eda4ff0e4384d4d87
SHA1 91b3aca68b974f7f227a19d5193abc41ab1fb57f
SHA256 566729a30e9eb2ec17855aa0bca0b68bb6e239067725f05b4fcbb10c1e9ea851
SHA512 07eb18849cd6247b16a4eb48e55dce3a8212c318ac13ca04bb40d0daa59c33ddffbe836975c10263e991183c2f24564df1cd51980239a935ebf81f49fa34bb53

C:\Users\Admin\AppData\Local\Temp\svchost\@Kypidss.exe

MD5 6feb31e3fbfadaf1029223c60bc0d60c
SHA1 13555e90f6bd008c03403e09fcd17d6a65ab461f
SHA256 b059aaa7da26904746289493bcc558f552408b0a4df2e86ff8ed0c675f4dc23e
SHA512 5680e753eb00386413fa4352a9169b6a0d1eb13b6ae5fe9c167e9999d40634d9318fe2bc91c6f76df22f00e0dc174fc38207a601024bf9f3093e71924eef44cb

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\ANTISC~1.DAT

MD5 029d8f9ffcbaa8d159537ecb51b8b40d
SHA1 bc67ac7339d5f92f5f8b82914570346a7726ad56
SHA256 a517d9a37af067b1135f901ef24a4569e810aeddbedc188be70eb25ce865a5d9
SHA512 5d6d169ba7c674356c1062ffcea5cf003b1ec00c7c9172f981d194a067cb72869311f107b8a18aa4c964d8d97852212fb7c76a6a9ef7c737d8f6841f17f7e7dd

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_2.zip

MD5 eb3589a039e50801ccedbdc2fe019213
SHA1 db1689b29d5a18d0a39c4c2cab8969c5cd54b67e
SHA256 d688fa7f2429ca3047284470660bc28b75209f3451b1b50eda6e8a75a970c0d5
SHA512 d452d0b63aea51e77fba2726d76824607750299ccbe3fdb73373339ea392a30d0deae8864bb9624340c635255f194558350d223fb04c1c03992e2d9e07aca4fe

memory/2680-92-0x0000000000370000-0x000000000038E000-memory.dmp

memory/2680-93-0x00000000741D0000-0x00000000748BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_5.zip

MD5 6c4fe4407cbe541fbad8fe96caa4cd8c
SHA1 66e09294d336eeebbc632f5cd11e63f078c1492b
SHA256 b6be02309134d09336a28d03812a98a61cb1e43b8458c258f39a70477b69a0e6
SHA512 3415ef2f80113c8424092f8404da3aa97adc5463a5acfc6475b41048c7b09b2d712a5f31689b5854ee7c7971721cd3e2576b8366cf6d62878973fe4c3af5597e

memory/2680-94-0x0000000002020000-0x0000000002060000-memory.dmp

memory/2680-95-0x00000000741D0000-0x00000000748BE000-memory.dmp