Malware Analysis Report

2024-10-10 08:02

Sample ID 240611-jpzcdszarb
Target c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.zip
SHA256 cf6a5918ae91f2ed5b91b5dbe28f4b1ef985416019099c542fb84360b7ff1283
Tags
themida evasion trojan
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

cf6a5918ae91f2ed5b91b5dbe28f4b1ef985416019099c542fb84360b7ff1283

Threat Level: Likely malicious

The file c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.zip was found to be: Likely malicious.

Malicious Activity Summary

themida evasion trojan

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Program crash

Unsigned PE

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Opens file in notepad (likely ransom note)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 07:51

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 07:51

Reported

2024-06-11 07:54

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe

"C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

N/A

Files

memory/2952-0-0x0000000000840000-0x0000000000FB6000-memory.dmp

memory/2952-1-0x0000000077C00000-0x0000000077C02000-memory.dmp

memory/2952-2-0x0000000000840000-0x0000000000FB6000-memory.dmp

memory/2952-4-0x0000000000840000-0x0000000000FB6000-memory.dmp

memory/2952-7-0x0000000000840000-0x0000000000FB6000-memory.dmp

memory/2952-8-0x0000000000840000-0x0000000000FB6000-memory.dmp

memory/2952-6-0x0000000000840000-0x0000000000FB6000-memory.dmp

memory/2952-5-0x0000000000840000-0x0000000000FB6000-memory.dmp

memory/2952-3-0x0000000000840000-0x0000000000FB6000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\D

MD5 5f54d1240735d46980b776af554f44d3
SHA1 acf7707c08973ddfdb27cd361442ccfba355c888
SHA256 2c80619d7e7c58257293cda3a878c13e5856f4e06f6f90601276f7b9179c9e07
SHA512 b1f542f68a48608ae53904fbe2105bd8f3e544941abb38ec9d24cb7a26f916ef94cfb431cce0c64077dc2934913130d78492914a5e9ffc52f311e68217caef15

C:\Users\Admin\Videos\CBhwKBgQD.README.txt

MD5 61c324611e6b2e1b180664f7a7982a7e
SHA1 2fd5af80cbe4c805edc71f1d29fd442eabf7109f
SHA256 cfac38a276ea508da50703915692cb8bd9d734ce74dc051239beb68cf89b2b37
SHA512 7ec1f946f8f659994899c6b8c9b2e6af61d763882dc419e3e18bf98b5884cfdae16e09c27d308ae022df51ec1ed2e3e9b38e970c94c473669f702c33b4876378

memory/2952-607-0x0000000000840000-0x0000000000FB6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 07:51

Reported

2024-06-11 07:52

Platform

win10v2004-20240426-en

Max time kernel

16s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe

"C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4028 -ip 4028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 884

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CBhwKBgQD.README.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp

Files

memory/4028-0-0x00000000008E0000-0x0000000001056000-memory.dmp

memory/4028-1-0x0000000077864000-0x0000000077866000-memory.dmp

memory/4028-2-0x00000000008E0000-0x0000000001056000-memory.dmp

memory/4028-3-0x00000000008E0000-0x0000000001056000-memory.dmp

memory/4028-8-0x00000000008E0000-0x0000000001056000-memory.dmp

memory/4028-6-0x00000000008E0000-0x0000000001056000-memory.dmp

memory/4028-5-0x00000000008E0000-0x0000000001056000-memory.dmp

memory/4028-7-0x00000000008E0000-0x0000000001056000-memory.dmp

memory/4028-4-0x00000000008E0000-0x0000000001056000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\A

MD5 5f54d1240735d46980b776af554f44d3
SHA1 acf7707c08973ddfdb27cd361442ccfba355c888
SHA256 2c80619d7e7c58257293cda3a878c13e5856f4e06f6f90601276f7b9179c9e07
SHA512 b1f542f68a48608ae53904fbe2105bd8f3e544941abb38ec9d24cb7a26f916ef94cfb431cce0c64077dc2934913130d78492914a5e9ffc52f311e68217caef15

C:\Users\Admin\Searches\CBhwKBgQD.README.txt

MD5 61c324611e6b2e1b180664f7a7982a7e
SHA1 2fd5af80cbe4c805edc71f1d29fd442eabf7109f
SHA256 cfac38a276ea508da50703915692cb8bd9d734ce74dc051239beb68cf89b2b37
SHA512 7ec1f946f8f659994899c6b8c9b2e6af61d763882dc419e3e18bf98b5884cfdae16e09c27d308ae022df51ec1ed2e3e9b38e970c94c473669f702c33b4876378

memory/4028-1342-0x00000000008E0000-0x0000000001056000-memory.dmp