Malware Analysis Report

2024-10-23 19:44

Sample ID 240421-khngzsfe71
Target 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
SHA256 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0

Threat Level: Known bad

The file 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

Nanocore family

NanoCore

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks whether UAC is enabled

Drops file in Program Files directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-21 08:36

Signatures

Nanocore family

nanocore

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-21 08:36

Reported

2024-04-21 08:38

Platform

win7-20231129-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\TCP Service\tcpsv.exe C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A
File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

"C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1796.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1833.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.209.94:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.209.94:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.209.94:11720 0.tcp.eu.ngrok.io tcp

Files

memory/2892-0-0x00000000745B0000-0x0000000074B5B000-memory.dmp

memory/2892-1-0x0000000001D90000-0x0000000001DD0000-memory.dmp

memory/2892-2-0x00000000745B0000-0x0000000074B5B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1796.tmp

MD5 9913e267519b245bd05576cd155e618b
SHA1 f9988cc21222e156d8df51cc1c67ff394e0baa9a
SHA256 db8d12fa91ed89d361af77401bd08785c5b7d538627fe2591c69ad675daee81d
SHA512 fec48c5fec8a03bc55ff319580a512fcbe476d309cfb4dc8563f3cf5266a68418b8a200a2e6f0fb1131c936f6a9d79cdb0ba72e6f225c36921c6188021acd882

C:\Users\Admin\AppData\Local\Temp\tmp1833.tmp

MD5 93fc3117767507c9889abd12dc667d22
SHA1 1096e4cfa0c35756e3c3fb866c1e4c1e59115df9
SHA256 684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a
SHA512 e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc

memory/2892-10-0x00000000745B0000-0x0000000074B5B000-memory.dmp

memory/2892-11-0x0000000001D90000-0x0000000001DD0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-21 08:36

Reported

2024-04-21 08:38

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Manager = "C:\\Program Files (x86)\\LAN Manager\\lanmgr.exe" C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\LAN Manager\lanmgr.exe C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A
File opened for modification C:\Program Files (x86)\LAN Manager\lanmgr.exe C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

"C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp54D7.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5545.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 134.223.125.3.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
NL 23.62.61.75:443 www.bing.com tcp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 39.102.125.3.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 75.249.158.18.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 154.173.246.72.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.209.94:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 94.209.125.3.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.102.39:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.209.94:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 165.31.192.18.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.209.94:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 3.125.223.134:11720 0.tcp.eu.ngrok.io tcp
BE 2.17.197.240:80 tcp

Files

memory/2724-0-0x0000000074C90000-0x0000000075241000-memory.dmp

memory/2724-1-0x0000000074C90000-0x0000000075241000-memory.dmp

memory/2724-2-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp54D7.tmp

MD5 9913e267519b245bd05576cd155e618b
SHA1 f9988cc21222e156d8df51cc1c67ff394e0baa9a
SHA256 db8d12fa91ed89d361af77401bd08785c5b7d538627fe2591c69ad675daee81d
SHA512 fec48c5fec8a03bc55ff319580a512fcbe476d309cfb4dc8563f3cf5266a68418b8a200a2e6f0fb1131c936f6a9d79cdb0ba72e6f225c36921c6188021acd882

C:\Users\Admin\AppData\Local\Temp\tmp5545.tmp

MD5 d7e9b664af56ade4d18b0b895f9ae715
SHA1 f16f53d11622da2103a9005b5ff1ab9ca799982f
SHA256 60f5742e0f45b4e9a63aef570028deb0e82be84f51e1d280643961f05c516c33
SHA512 5caff8477b1ba3e3832fc5783dca09670e251ea3d3f9753bf8862776a8595697bf3870b47bc64de2d1f358205fb90288ca2871da5e81adad79766522616c3ec6

memory/2724-10-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

memory/2724-11-0x0000000074C90000-0x0000000075241000-memory.dmp

memory/2724-12-0x0000000074C90000-0x0000000075241000-memory.dmp

memory/2724-13-0x0000000000CC0000-0x0000000000CD0000-memory.dmp