Malware Analysis Report

2024-10-19 07:12

Sample ID 240505-thk7ased7s
Target 1866220d126c6d128924df0fcc9fafe8_JaffaCakes118
SHA256 6dd49b5cdb2079aa2991ea7f480661f72c1c29faaf92c4a0132278fff7a34044
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6dd49b5cdb2079aa2991ea7f480661f72c1c29faaf92c4a0132278fff7a34044

Threat Level: Known bad

The file 1866220d126c6d128924df0fcc9fafe8_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops desktop.ini file(s)

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-05 16:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-05 16:03

Reported

2024-05-05 16:06

Platform

win7-20240221-en

Max time kernel

148s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\order432017.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Files = "\"C:\\Users\\Admin\\AppData\\Roaming\\Programs\\Invoice.exe\"" C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Host = "C:\\Program Files (x86)\\DHCP Host\\dhcphost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2368 set thread context of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1756 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1756 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1756 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1756 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1756 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1756 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1756 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2784 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2480 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 2784 wrote to memory of 2480 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 2784 wrote to memory of 2480 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 2784 wrote to memory of 2480 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 2784 wrote to memory of 2480 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 2784 wrote to memory of 2480 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 2784 wrote to memory of 2480 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 2480 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2480 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2480 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2480 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2480 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2480 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2480 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 2368 wrote to memory of 1804 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 1804 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 1804 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 1804 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 320 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 320 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 320 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 320 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2368 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\order432017.exe

"C:\Users\Admin\AppData\Local\Temp\order432017.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\order432017.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null

C:\Windows\SysWOW64\cmd.exe

cmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"

C:\Windows\SysWOW64\cmd.exe

cmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"

C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE

C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE":Zone.Identifier) 2 > Null

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.exe":Zone.Identifier) 2 > Null

C:\Windows\SysWOW64\cmd.exe

cmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"

C:\Windows\SysWOW64\cmd.exe

cmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp22DC.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp231B.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp

Files

memory/1756-0-0x00000000744A1000-0x00000000744A2000-memory.dmp

memory/1756-1-0x00000000744A0000-0x0000000074A4B000-memory.dmp

memory/1756-2-0x00000000744A0000-0x0000000074A4B000-memory.dmp

memory/1756-3-0x00000000744A0000-0x0000000074A4B000-memory.dmp

memory/2784-6-0x00000000744A0000-0x0000000074A4B000-memory.dmp

memory/2784-7-0x00000000744A0000-0x0000000074A4B000-memory.dmp

memory/2784-5-0x00000000744A0000-0x0000000074A4B000-memory.dmp

memory/1756-4-0x00000000744A0000-0x0000000074A4B000-memory.dmp

\Users\Admin\AppData\Roaming\Programs\Invoice.EXE

MD5 964727c8e4fae448d46f90d655eb0858
SHA1 927cc815ed091edfd1f34641e0855418c91384be
SHA256 eb439cba780d8e342ea0cb729f3a44f559e94c1b05f68888baae089f1d8989e8
SHA512 34b3f588951bd47b8c375e1e4af5911d9a1cf9165634358944584d27dff76fa9bd66305d63db1291b0a2f6d938e1b35d6bd895afc5b7b86ad0a4c4f2e959caab

memory/2784-14-0x00000000744A0000-0x0000000074A4B000-memory.dmp

memory/2184-17-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2184-26-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2184-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2184-23-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2184-21-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2184-20-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2184-28-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2184-27-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp22DC.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

C:\Users\Admin\AppData\Local\Temp\tmp231B.tmp

MD5 0479d5f304ef2d7e3c15fb24a99f88c1
SHA1 8edbb1450a656fac5f5e96779ffe440ee8c1aec9
SHA256 112557c2b2d0c669a3b115129dc32f005341e965330fa8f2ad3e5de1926594bc
SHA512 537e8d87e5cd975f0e69bb145f81d6e9d7b0d82eed143ac351304ea38577137386a51fdb7357ec6d641eb04ff5f51e249bba2db8a4b5bf2934d561394a4a3f15

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-05 16:03

Reported

2024-05-05 16:06

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\order432017.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\order432017.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Files = "\"C:\\Users\\Admin\\AppData\\Roaming\\Programs\\Invoice.exe\"" C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\order432017.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\order432017.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3820 set thread context of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DPI Service\dpisvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\DPI Service\dpisvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\order432017.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\order432017.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\order432017.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4504 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 4504 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 4504 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\order432017.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1680 wrote to memory of 1888 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 1888 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 1888 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 2856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 4100 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 4100 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 4100 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 1820 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 1680 wrote to memory of 1820 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 1680 wrote to memory of 1820 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE
PID 1820 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\SysWOW64\cmd.exe
PID 1820 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\SysWOW64\cmd.exe
PID 1820 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\SysWOW64\cmd.exe
PID 1820 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1820 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 1820 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
PID 3820 wrote to memory of 4284 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 4284 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 4284 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 2824 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 3324 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 3324 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 3324 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 948 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3820 wrote to memory of 976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 976 wrote to memory of 4460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 4460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 4460 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 3964 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 3964 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 3964 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\order432017.exe

"C:\Users\Admin\AppData\Local\Temp\order432017.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\order432017.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Local\Temp\order432017.exe":Zone.Identifier) 2 > Null

C:\Windows\SysWOW64\cmd.exe

cmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"

C:\Windows\SysWOW64\cmd.exe

cmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"

C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE

C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE":Zone.Identifier) 2 > Null

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c (echo. > "C:\Users\Admin\AppData\Roaming\Programs\Invoice.exe":Zone.Identifier) 2 > Null

C:\Windows\SysWOW64\cmd.exe

cmd /c mkdir "C:\Users\Admin\AppData\Roaming\Programs"

C:\Windows\SysWOW64\cmd.exe

cmd /c type NUL>"C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp30CF.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp311E.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 142.126.19.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 labibeautyparlour.ddns.net udp
US 8.8.4.4:53 labibeautyparlour.ddns.net udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/4504-0-0x0000000075512000-0x0000000075513000-memory.dmp

memory/4504-1-0x0000000075510000-0x0000000075AC1000-memory.dmp

memory/4504-2-0x0000000075510000-0x0000000075AC1000-memory.dmp

memory/4504-5-0x0000000075512000-0x0000000075513000-memory.dmp

memory/4504-6-0x0000000075510000-0x0000000075AC1000-memory.dmp

memory/4504-8-0x0000000075510000-0x0000000075AC1000-memory.dmp

memory/1680-9-0x0000000075510000-0x0000000075AC1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Programs\Invoice.EXE

MD5 964727c8e4fae448d46f90d655eb0858
SHA1 927cc815ed091edfd1f34641e0855418c91384be
SHA256 eb439cba780d8e342ea0cb729f3a44f559e94c1b05f68888baae089f1d8989e8
SHA512 34b3f588951bd47b8c375e1e4af5911d9a1cf9165634358944584d27dff76fa9bd66305d63db1291b0a2f6d938e1b35d6bd895afc5b7b86ad0a4c4f2e959caab

memory/1680-14-0x0000000075510000-0x0000000075AC1000-memory.dmp

memory/976-18-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp30CF.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

C:\Users\Admin\AppData\Local\Temp\tmp311E.tmp

MD5 0d6d94a917c4ce63da6bc50cbbe0dc5d
SHA1 599564f60649f3f4c14478e9cb184000d4280a61
SHA256 e82a4b8311319f1b68cb06ae5b670e97a11c467b1bdb0ebf130f523bf98ca522
SHA512 23ac6a088e2a1df3d75d2aca17cdcc5a4147b966758e4acc4d904293f4693f362db637d8135edd670e158bec77e788e915f2a55042a2f1aec09a4679bc749412