Malware Analysis Report

2024-10-23 19:44

Sample ID 240427-npxwsaac2s
Target 0329392630eee094482ce54d45eb6e4d_JaffaCakes118
SHA256 d59d14279f8a1b9887a83a2ea99c6e161c94774f3603e46eeb52b11417c753ab
Tags
nanocore keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d59d14279f8a1b9887a83a2ea99c6e161c94774f3603e46eeb52b11417c753ab

Threat Level: Known bad

The file 0329392630eee094482ce54d45eb6e4d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-27 11:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-27 11:34

Reported

2024-04-27 11:37

Platform

win7-20240419-en

Max time kernel

137s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DOS Manager = "C:\\Program Files (x86)\\DOS Manager\\dosmgr.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2400 set thread context of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DOS Manager\dosmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
File opened for modification C:\Program Files (x86)\DOS Manager\dosmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2888 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2888 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2888 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2888 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2888 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2888 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2888 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2400 wrote to memory of 2812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2812 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DOS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp92ED.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DOS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp934B.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.4.4:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.4.4:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.4.4:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp

Files

memory/2888-0-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2888-1-0x0000000000940000-0x0000000000980000-memory.dmp

memory/2888-2-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2888-3-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2400-6-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2400-5-0x0000000000410000-0x0000000000450000-memory.dmp

memory/2400-4-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2400-7-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2812-13-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2812-16-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2400-21-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2812-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2812-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2812-12-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2812-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2812-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2812-8-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2812-23-0x0000000002140000-0x0000000002180000-memory.dmp

memory/2812-22-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2812-24-0x0000000073FE0000-0x000000007458B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp92ED.tmp

MD5 776580d2028b74ed89bb21146482bdff
SHA1 d1a45290dedde63d8539a2fc8af866b430238bc7
SHA256 fbad359469fc6aefb5695d01974f4edf50528f51f80d57b9eb0d8f2f81033cc0
SHA512 de084f473db26ce159b639b02e7ffa263ae5b6c4c1da9f6932676dae4a6c65f082b1bcac673c45c2e2b84caa06d1860ea6f0545b81fd7b3e4f8fe5e802a160d3

C:\Users\Admin\AppData\Local\Temp\tmp934B.tmp

MD5 8f5713b14cee3089852f6c8d2a7a7d57
SHA1 8bffbea05715c6434ad593cce8a2c737f80ff788
SHA256 ab3ce102242c3144f87bcbfe83984a478821cd09e62c0e5211b2ab37dde02d2c
SHA512 82bd2378c2d6bb34a1ad3f2d26bfea583fc8403691bed6668521ba3e8bc7bdbdf142f872ddbc8e5251550f47c9bbee4eb3d0d6096f80d85259082cf68a454c72

memory/2812-32-0x0000000073FE0000-0x000000007458B000-memory.dmp

memory/2812-33-0x0000000002140000-0x0000000002180000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-27 11:34

Reported

2024-04-27 11:37

Platform

win10v2004-20240419-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3908 set thread context of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3976 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3976 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3976 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3908 wrote to memory of 3916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3916 wrote to memory of 892 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 892 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 892 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 2948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 2948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 2948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\0329392630eee094482ce54d45eb6e4d_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBC0C.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBC5C.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.4.4:53 snopper13.ddns.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.4.4:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp
US 8.8.4.4:53 snopper13.ddns.net udp
US 8.8.8.8:53 snopper13.ddns.net udp

Files

memory/3976-0-0x0000000074A40000-0x0000000074FF1000-memory.dmp

memory/3976-1-0x0000000000820000-0x0000000000830000-memory.dmp

memory/3976-2-0x0000000074A40000-0x0000000074FF1000-memory.dmp

memory/3976-4-0x0000000074A40000-0x0000000074FF1000-memory.dmp

memory/3908-6-0x0000000001780000-0x0000000001790000-memory.dmp

memory/3908-5-0x0000000074AE0000-0x0000000075091000-memory.dmp

memory/3908-7-0x0000000074AE0000-0x0000000075091000-memory.dmp

memory/3908-8-0x0000000074AE0000-0x0000000075091000-memory.dmp

memory/3908-9-0x0000000001780000-0x0000000001790000-memory.dmp

memory/3908-10-0x0000000001780000-0x0000000001790000-memory.dmp

memory/3916-11-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\installutil.exe.log

MD5 7a4a84f4d2df1fe011638038702dad89
SHA1 64e9856d95b2064ff51e1c77819c818e6e5b3291
SHA256 cfd5734d90e6889355768ae5a723076000d88af2e5b6b435d55fa5bfa3e29590
SHA512 cbe9f7724806d161e70a161525c89199e10e6f38ad425533defaa1e02a12bf2cf28cba6788ed68e446cbd4286541e341b55c40133c134f9fcf94cae79b34092d

memory/3916-16-0x0000000001030000-0x0000000001040000-memory.dmp

memory/3916-15-0x0000000074AE0000-0x0000000075091000-memory.dmp

memory/3908-14-0x0000000074AE0000-0x0000000075091000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpBC0C.tmp

MD5 776580d2028b74ed89bb21146482bdff
SHA1 d1a45290dedde63d8539a2fc8af866b430238bc7
SHA256 fbad359469fc6aefb5695d01974f4edf50528f51f80d57b9eb0d8f2f81033cc0
SHA512 de084f473db26ce159b639b02e7ffa263ae5b6c4c1da9f6932676dae4a6c65f082b1bcac673c45c2e2b84caa06d1860ea6f0545b81fd7b3e4f8fe5e802a160d3

C:\Users\Admin\AppData\Local\Temp\tmpBC5C.tmp

MD5 93d357e6194c8eb8d0616a9f592cc4bf
SHA1 5cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256 a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA512 4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

memory/3916-24-0x0000000074AE0000-0x0000000075091000-memory.dmp

memory/3916-25-0x0000000001030000-0x0000000001040000-memory.dmp