Malware Analysis Report

2025-01-03 08:14

Sample ID 240704-c3e3cazenk
Target 245804c90ab194a49f8479c4273e3b40_JaffaCakes118
SHA256 0ac713f55b6d7b3191815abb1f80525f87c77f04f2714355ec245bbaab5b8885
Tags
metasploit backdoor evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0ac713f55b6d7b3191815abb1f80525f87c77f04f2714355ec245bbaab5b8885

Threat Level: Known bad

The file 245804c90ab194a49f8479c4273e3b40_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor evasion trojan

MetaSploit

Modifies firewall policy service

Modifies security service

Drops file in System32 directory

Unsigned PE

Runs .reg file with regedit

Runs net.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-04 02:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 02:35

Reported

2024-07-04 02:38

Platform

win7-20240611-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\regedit.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\serivces.exe C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\serivces.exe C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 1372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 1372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 1372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1372 wrote to memory of 2284 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1372 wrote to memory of 2284 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1372 wrote to memory of 2284 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1372 wrote to memory of 2284 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2736 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2308 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2308 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2308 wrote to memory of 2600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2564 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2808 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2808 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2808 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2808 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2404 wrote to memory of 2560 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2404 wrote to memory of 2560 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2404 wrote to memory of 2560 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2404 wrote to memory of 2560 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2472 wrote to memory of 2612 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2472 wrote to memory of 2612 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2472 wrote to memory of 2612 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2472 wrote to memory of 2612 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c net stop SharedAccess

C:\Windows\SysWOW64\net.exe

net stop SharedAccess

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SharedAccess

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\cmd.exe

cmd /c net stop "Security Center"

C:\Windows\SysWOW64\cmd.exe

cmd /c net start SharedAccess

C:\Windows\SysWOW64\net.exe

net start SharedAccess

C:\Windows\SysWOW64\net.exe

net stop "Security Center"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start SharedAccess

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Security Center"

Network

N/A

Files

memory/2736-1-0x0000000000020000-0x0000000000022000-memory.dmp

memory/2736-0-0x0000000000400000-0x0000000000481000-memory.dmp

C:\a.bat

MD5 d807ec0161c542b23e37898db356c95b
SHA1 0aac2ef8e1d77868d932a10007efcbd0b69ecdfc
SHA256 56cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37
SHA512 538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf

C:\Users\Admin\AppData\Local\Temp\1.reg

MD5 70237e6c7f12f17048117b2e1098aef9
SHA1 b9735214963e8e3b791bf7113bebbbbf65c4d36d
SHA256 6d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c
SHA512 bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee

memory/2736-33-0x0000000000400000-0x0000000000481000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 02:35

Reported

2024-07-04 02:38

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\regedit.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\serivces.exe C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\serivces.exe C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3400 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2084 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2084 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 904 wrote to memory of 2832 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 904 wrote to memory of 2832 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 904 wrote to memory of 2832 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3400 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2860 wrote to memory of 1296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2860 wrote to memory of 1296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2860 wrote to memory of 1296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3400 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3400 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4756 wrote to memory of 3244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4756 wrote to memory of 3244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4756 wrote to memory of 3244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4000 wrote to memory of 712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4000 wrote to memory of 712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4000 wrote to memory of 712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 3244 wrote to memory of 3332 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3244 wrote to memory of 3332 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3244 wrote to memory of 3332 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 712 wrote to memory of 2908 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 712 wrote to memory of 2908 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 712 wrote to memory of 2908 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\245804c90ab194a49f8479c4273e3b40_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c net stop SharedAccess

C:\Windows\SysWOW64\net.exe

net stop SharedAccess

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SharedAccess

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\cmd.exe

cmd /c net stop "Security Center"

C:\Windows\SysWOW64\cmd.exe

cmd /c net start SharedAccess

C:\Windows\SysWOW64\net.exe

net start SharedAccess

C:\Windows\SysWOW64\net.exe

net stop "Security Center"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start SharedAccess

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Security Center"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

memory/3400-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

memory/3400-0-0x0000000000400000-0x0000000000481000-memory.dmp

\??\c:\a.bat

MD5 d807ec0161c542b23e37898db356c95b
SHA1 0aac2ef8e1d77868d932a10007efcbd0b69ecdfc
SHA256 56cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37
SHA512 538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf

C:\Users\Admin\AppData\Local\Temp\1.reg

MD5 9b0e9235bde6c376e82cc33f967e9a2f
SHA1 78723d31ffa8fd8f83389d2840fd79d509751d41
SHA256 55354185b2c82303199218cda9417e98ef4f6889ad6c6427f2557f7eef08874c
SHA512 a36cee14d865738a6be783d5b3bc42e968e10af3f8fc0e4b6e19688969307d284f5f25ffcc69e0dff5c2a9ffee86e7ac2428309045a5dd20fe24c95090c6938c

C:\Users\Admin\AppData\Local\Temp\1.reg

MD5 70237e6c7f12f17048117b2e1098aef9
SHA1 b9735214963e8e3b791bf7113bebbbbf65c4d36d
SHA256 6d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c
SHA512 bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee

memory/3400-29-0x0000000000400000-0x0000000000481000-memory.dmp